Truth about running Cloud Security Assessments in 2021
summary
Claims that cloud docs and well‑architected guides rarely match reality: many orgs have dozens of accounts and hundreds of services in one tenancy; CSPMs and CASBs spit a CSPM wall of red full of false positives because they lack architectural context; both point‑in‑time audits and continuous monitoring are necessary; using infrastructure‑as‑code checks (Checkov/Bridgecrew style) and small automation scripts actually halves audit time by running read‑only scans and mapping surprises; final warning: passing compliance checklists does not equal being secure.
AI-written summary · about
chapters (14)
- 0:00Cloud security assessments intro
- 2:04Speaker background
- 3:28Security frameworks
- 4:51Cloud assessment realities
- 7:40Cloud adoption types
- 10:09Source access challenges
- 11:55Automation benefits
- 13:42Cloud threats and kill chains
- 16:07Public app identity risks
- 18:35Assessment types compared
- 21:01CSPM limitations
- 24:53Assessment tools
- 26:17Compliance truths
- 28:43Final takeaways and trusted advisors
related talks
58mCloud Attack Surface Management
43mWalking on Broken Clouds
31mSeeing Through the Fog - Navigating the Security Landscape of a Cloud-First World
51mCloudSec Hero to Zero: Self-Obsolescing Through Prolific Efficiency
29mCloud compliance and assurance
31mA Comprehensive Approach to Cloud Security Posture Management
24mCracking the Code of Cloud Security
57mCloud’s Dirty Little Secret: It Was Misconfigs All Along