Free AI web copilot to create summaries, insights and extended knowledge, download it at here

7242

Abstract

="a74d" class="link-block"> <a href="https://readmedium.com/assessing-supply-chain-geopolitical-risk-c1a74384660d"> <div> <div> <h2>Assessing Supply Chain Geopolitical Risk</h2> <div><h3>ACM.179 Where does the company in your supply chain build, test, and sell their products?</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*mQyFnHUDl6nGW3jWMcaWeg.png)"></div> </div> </div> </a> </div><p id="4942">I block traffic from DigitalOcean on my network due to all the scanning coming from that platform. Not sure if I would want those neighbors. That’s why I don’t use it, personally.</p><p id="3191">IBM and Oracle don’t have enough market share and have had some issues in the past, which is why I am not going to take the time to cover them here, but everything changes over time. IBM and Oracle used to be powerhouses. So I’m not saying they are bad or you shouldn’t use them. Oracle has some application-specific use cases as do some other vendors. The concepts I write about in this series will be applicable to any IAAS cloud platform.</p><h2 id="8742">SAAS</h2><p id="8185">I may also touch on <b>SAAS cloud platforms</b>. I wrote about why those are challenging here.</p><div id="7bf2" class="link-block"> <a href="https://readmedium.com/cspm-vs-sspm-70a2564ebc23"> <div> <div> <h2>Cloud (CSPM) and SaaS Security Posture Management (SSPM)</h2> <div><h3>ACM.162 Security posture management products for cloud security — do they work?</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*2BqXjA9JUtRNK-4V-9y2Bw.png)"></div> </div> </div> </a> </div><h2 id="34fd">Multi-Cloud Security</h2><div id="a501" class="link-block"> <a href="https://readmedium.com/visibility-at-the-enterprise-level-in-a-multi-cloud-environment-413258ab2a7c"> <div> <div> <h2>Visibility at the Enterprise Level in a Multi-Cloud Environment</h2> <div><h3>MultiCloud.2 Are you seeing everything in, to, and from your clouds?</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*Bwq4Q0lmt0wqTL_ftbsOng.png)"></div> </div> </div> </a> </div><div id="abee" class="link-block"> <a href="https://readmedium.com/before-you-open-the-cloud-account-913788b7f960"> <div> <div> <h2>Before You Open the Cloud Account</h2> <div><h3>Multicloud.3 Assessing your vendors for security gaps and risks</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*uBqf1aOGga0AoVlkZ27WfQ.png)"></div> </div> </div> </a> </div><div id="fa25" class="link-block"> <a href="https://readmedium.com/opening-a-cloud-account-securely-da62e281803f"> <div> <div> <h2>Opening a Cloud Account Securely</h2> <div><h3>MultiCloud.4 Who has the root credentials?</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*hI84ikrVAvwuVM7P.png)"></div> </div> </div> </a> </div><div id="206f" class="link-block"> <a href="https://readmedium.com/organizational-hierarchies-and-policies-in-aws-azure-and-gcp-3de512468201"> <div> <div> <h2>Organizational Hierarchies and Policies in AWS, Azure, and GCP</h2> <div><h3>Multicloud.5 Accounts, OUs, Subscriptions, Tenants, Folders and Projects</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*IJWNUteUkdUxtLS4WdV38A.png)"></div> </div> </div> </a> </div><div id="00d1" class="link-block"> <a href="https://readmedium.com/programmatic-governance-in-azure-6858f2317f8b"> <div> <div> <h2>Programmatic Governance in Azure</h2> <div><h3>Multicloud.6 Using Azure ARM or Bicep templates to govern all the things</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*DbSLYV9aR4dy7uLIvyj6-g.png)"></div> </div> </div> </a> </div><div id="8c73" class="link-block"> <a href="https://readmedium.com/programmatic-governance-in-gcp-176f1180bc19"> <div> <div> <h2>Programmatic Governance in GCP</h2> <div><h3>Multicloud.7 Deployments, Configurations, Templates, glcoud, and API calls</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*BLb93kSj-aJ9XakFW8eIXQ.png)"></div> </div> </div> </a> </div><div id="c3e5" class="link-block"> <a href="https://readmedium.com/programmatic-governance-in-aws-f521f057637"> <div> <div> <h2>Programmatic Governance in AWS</h2> <div><h3>Multicloud.7 Using CloudFormation, Accounts, OUs, and Service Control Policies for governance on AWS</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*OBJW5Trw7ZQTfBnf.png)"></div> </div> </div> </a> </div><div id="bc0e" class="link-block"> <a href="https://readmedium.com/abstraction-for-multi-cloud-security-36fad32ea8b2"> <div> <div> <h2>Abstraction for Multi-Cloud Security</h2> <div><h3>Multicloud.8 How the principle of abstraction applies to multi-cloud security</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*QYPtUunGRlafmTUw4GL0FA.png)"></div> </div> </div> </a> </div><div id="420d" class="link-block"> <a href="https://readmedium.com/letting-te

Options

rraform-handle-the-complexity-of-multi-cloud-deployments-fe1d0580b8f5"> <div> <div> <h2>Letting Terraform Handle The Complexity of Multi-Cloud Deployments</h2> <div><h3>Multicould.9 You’re not actually reducing the complexity, you’re letting someone else handle it — understand the…</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*6cPephkZbbvVV8kaRKbYBg.png)"></div> </div> </div> </a> </div><div id="60b0" class="link-block"> <a href="https://readmedium.com/drift-detection-for-multi-cloud-security-e5f17e8f8e96"> <div> <div> <h2>Drift Detection for Multi-Cloud Security</h2> <div><h3>Multicloud.10 How drift detection can help you find non-compliant resources</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*b2OTw4yKRzH_y_Ta.png)"></div> </div> </div> </a> </div><div id="e8f6" class="link-block"> <a href="https://readmedium.com/iam-for-multi-cloud-security-39c9f5b6b32e"> <div> <div> <h2>IAM for Multi-Cloud Security</h2> <div><h3>Multicloud.11 IAM is challenging and one of your biggest cloud security risks</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*3vgLg5U4gHcjDRaFsRCtpQ.png)"></div> </div> </div> </a> </div><div id="878a" class="link-block"> <a href="https://readmedium.com/what-would-make-cloud-security-easier-b21646a5e6bb"> <div> <div> <h2>What Would Make Cloud Security Easier?</h2> <div><h3>Multicloud.12 A proposed standard for cloud deployments and drift detection</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*Lktn3wjObbBNkV88ICFrsg.png)"></div> </div> </div> </a> </div><p id="5374">Here are some stories I’ve already written on AWS, Azure, and GCP.</p><div id="d2ef" class="link-block"> <a href="https://readmedium.com/homomorphic-encryption-ab1dd73f13da"> <div> <div> <h2>Homomorphic Encryption</h2> <div><h3>When data is truly encrypted in use</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*Bb6A22zmggLfdRHp.png)"></div> </div> </div> </a> </div><div id="2017" class="link-block"> <a href="https://readmedium.com/keeping-vms-on-private-networks-on-azure-aws-and-gcp-10a4a5923d7b"> <div> <div> <h2>Keeping VMs on Private Networks on Azure, AWS, and GCP</h2> <div><h3>Nuances in multi-cloud networking and how it could contribute to cloud data breaches and security incidents</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*IKCItIGiPg1BF1Gf.png)"></div> </div> </div> </a> </div><div id="30b3" class="link-block"> <a href="https://readmedium.com/aws-security-8a038e16e1f1"> <div> <div> <h2>AWS Security</h2> <div><h3>A compilation of stories written about AWS by Teri Radichel</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*WB2nq8sNjaM_Uy9_PTtkLA.png)"></div> </div> </div> </a> </div><div id="68f8" class="link-block"> <a href="https://readmedium.com/azure-security-7d3f68d9ae1c"> <div> <div> <h2>Azure Security</h2> <div><h3>Posts on Azure Security by Teri Radichel</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*1Z1kIEwpeqLydmZXwNiCLg.png)"></div> </div> </div> </a> </div><div id="93a5" class="link-block"> <a href="https://readmedium.com/google-security-43ab82156840"> <div> <div> <h2>Google and Google Cloud Platform (GCP) Security</h2> <div><h3>Blog posts by Teri Radichel on Google, Google Cloud Platform (GCP), Chrome, Gmail and Google Workspace Security</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*3DvMQ0q9YCMv68LH4Ql4FA.png)"></div> </div> </div> </a> </div><p id="274e">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="5a42"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="faf5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

Multi-Cloud Security

MultiCloud.1 A series of posts on multi-cloud security by Teri Radichel

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics. The Code.

🔒 Related Stories: Multi-Cloud Security | AWS Security | Azure Security | GCP & Google Security.

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I’ve been working through a series of building a secure AWS infrastructure from the ground up with not only secure configurations, but proper governance.

Automating Cybersecurity Metrics (ACM)

A series of blog posts on cybersecurity metrics and security automation

medium.com

But I need to step away to work on a paid project related to multi-cloud security.

Come hang out in October 2023 in Atlanta

In preparation for an upcoming event I’ll be speaking at for IANS Research this year in October 3, 2023 in Atlanta, I’m revisiting this same topic, but I’m going to go a bit deeper. Perhaps I’ll even write and share some code. Come hang out with me and some other top security professionals.

2023 Atlanta Forum

This one-day virtual event is designed for security practitioners to gain actionable technical solutions and leadership…

www.iansresearch.com

I’m going to talk about some of the features and services that you can use across the major cloud providers to help you with governance. My post are going to be winding as I work through this topic. If you want the executive summary, a more organized take on the topic, or you want to ask me questions, come to the presentation at the forum.

If you have an immediate question, schedule a call with me through IANS Research.

I’ll be posting related stories here as I work through some concepts on multi-cloud security.

Cloud Governance

Governance is really the ticket to risk management and true security in any environment. You need to understand

Cloud Governance

Stories on Cloud Governance by Teri Radichel

medium.com

What is Cloud?

If you need an answer to the “What is Cloud” question, I wrote about that here.

What is Cloud?

Defining a nebulous term

medium.com

There is no easy button

If you heard me present at IANS Research events last year or your saw my slides presented by someone else, one of the first slides was “There is no easy button.”

Then I essentially proceeded to explain why. Vendors are trying to sell you Cloud Posture Security Management (CSPM) tools and other types of tools to solve all your problems — and those tools are good in some cases.

However, it is not enough to turn on the tools and stare at the pretty dashboards. Do you know what these tools are actually doing?

So much information…

Note that I used to teach a 5 consecutive day class on cloud security to organizations but I can’t even do that in good faith anymore. The topic is too broad and there’s too much to cover to do it justice. Additionally, keeping up with all the content from the cloud providers and keeping the content current is simply not feasible. Now I generally teach security concepts, or one cloud at a time, or governance only across three clouds at a very high level. That seems more appropriate. I also spread out the class so I have time in between each session to review and make sure the material is up to date.

Anything you read here is subject to change. The cloud providers change the names of services, features, screens, and more on a daily basis. I will try to provide links to the content so you can review them for the most up to date guidance, as I usually do in such stories.

Other Cloud Vendors

By the way, yes, I understand other clouds exist. My comment on Ali Baba is that I don’t know if you can be secure on that platform due to Chinese laws, but if you are working in China you might want to use it.

Assessing Supply Chain Geopolitical Risk

ACM.179 Where does the company in your supply chain build, test, and sell their products?

medium.com

I block traffic from DigitalOcean on my network due to all the scanning coming from that platform. Not sure if I would want those neighbors. That’s why I don’t use it, personally.

IBM and Oracle don’t have enough market share and have had some issues in the past, which is why I am not going to take the time to cover them here, but everything changes over time. IBM and Oracle used to be powerhouses. So I’m not saying they are bad or you shouldn’t use them. Oracle has some application-specific use cases as do some other vendors. The concepts I write about in this series will be applicable to any IAAS cloud platform.

SAAS

I may also touch on SAAS cloud platforms. I wrote about why those are challenging here.

Cloud (CSPM) and SaaS Security Posture Management (SSPM)

ACM.162 Security posture management products for cloud security — do they work?

medium.com