Building a Cloud Security Flywheel: Lessons from the Field
summary
Start by enabling centralized Activity Logs (CloudTrail across AWS Organizations or Azure Activity Logs) and forward them to long‑term storage and a SIEM, then enable managed detections (GuardDuty/Defender) and Macie for S3 classification. Run an ownership/tagging sweep, turn off unused resources and stale identities based on last‑used dates, and phase in guardrails via Service Control Policies or Azure Policy. Move to golden images and infrastructure‑as‑code for fast remediation, use private endpoints/bastion to reduce attack surface, and audit metrics to iterate the flywheel.
AI-written summary · about
chapters (13)
- 0:00Cloud security challenges
- 3:14First day in cloud security
- 6:45Easy security steps
- 8:52Activity Logs and CloudTrail
- 14:58Security detection tools
- 19:21Storage logs and data policies
- 25:20Cleaning up resources
- 31:40Identity risks and permissions
- 37:39Sensitive data protection
- 41:13Guardrails for security
- 46:51Infrastructure as code
- 47:36Network protection
- 49:03Building a security flywheel
related talks
16mSecuring your Cloud infrastructure: a first baseline
01h 02mStrong security made simple: Putting all the pieces together
25mUse lessons learned from the field to build for security
43mWalking on Broken Clouds
48mDevSecOps: Spin Up Cloud Security, Discover, Classify and Protect Sensitive Data
50mArchitecting a secure cloud framework
47m3 steps to help mitigate cloud risks
44mGuardrails in the Cloud