How do you secure your cloud architecture from external and internal threats?

Attacks are always a threat and some or other way it happening knowingly or unknowingly, but an architect you should always be very proactive to detect them. Keep both your eyes on resource usage, is it legit or not. Monitoring is the best way to detect. Restrict areas of access to non-required persons. Check for any abnormalities in your external facing components, e.g. error rate, same IP hit multiple time etc. Keep your workload inside the private VPC and let external world access via Gateway/Proxy Block legit users for not rotating keys as drill same for drill by hitting error rate as circuit breaker. Validate WAF rules mostly on CDN, try with AuthZ for any CDN access. As IOT is increasing look into your edge security strategy.

Securing your cloud architecture is like fortifying a castle against cyber threats. Start with strong walls (firewalls) for a solid perimeter defense. Continuous monitoring acts as vigilant guards, detecting unusual activities.

Identifying threats is one of the most important steps when securing a cloud environment. It can be adapted based on specific frameworks but also taking into account how each company defines risk and most importantly acceptable risk.

Least privileged is a known part in security advisory, however we have seen many time for sake of testing we allow a lot of access and then forgot to replace them, which give a backdoor while principle is compromise, avoid testing production environment. Regular visit your trusted advisor tool to see if any SG left open or any access token have not been rotated for along time. Avoid any full access permission forget about root access it should not given to any. Create a practice on GDPR worksheet on every workloads/applications this will bring down the risks, ask every time for any new access who, what and why add to the list till when. Keep your audit very strict on roles and access area.

Treat user access like keys; implement strict Identity and Access Management (IAM). Encrypt your data, making it unreadable without the proper key. Regularly audit your security measures and have an incident response plan in place for swift reactions.

From previous discuss as I was talking about no full access here it comes assume roles and get the keys for access the resource to do any execution, adopt this process will help to rectify any compromise sooner. Baseline your key management policy organization wide any external access should not have without SSL/TLS, define your key store, promote vault if you are using microservices keep your all code under scanner any secrets should not be release to external or even internal stack holders. We all know the KMS, HSM (Fintech) secret managers but look into your bill whether they are being used or not, this is good investment. Secure your software supply chain process within the pipelines itself the approach is shift left to reduce risks.

No firewall? shutdown your production workload, better go back fix that and then release. Apart from traditional Firewall, its the time to adopt the segregation of workload by needs so we can easily go back and fix the issues or at least reduce the impact. There are lot of best practice guide for Firewall and I am sure every architect have been following them but we may need to look for cost part as well while the traffic should not leave your promises or cloud account/Region/AZ unless its really need to response anywhere else, take a deep look into your traffic why these DTO cost is my routing perfect or there is opportunity to improve.

Network Segmentation: Implement network segmentation within your cloud architecture to isolate critical resources. Tools like AWS VPC Peering or Azure Network Security Groups help control traffic flow and minimize attack surfaces. Multi-Factor Authentication (MFA): Enforce MFA for cloud access. Solutions like Google Authenticator or Azure MFA add an extra layer of security by requiring multiple forms of verification. Cloud Access Security Brokers (CASBs): Employ CASBs like Bitglass or Netskope to monitor and protect data in real-time, even in remote work scenarios, ensuring compliance and threat detection.

Educate your team on the latest threats, social engineering is the most effective threat against all types of defense, also regularly back up data as a safeguard. In this dynamic landscape, adaptability and a holistic approach are key to a secure cloud fortress.