Cloud & Infrastructure Security
The substrate everything else runs on.
Every other pillar already touches cloud, but always through its own lens: who may act on it, what runs on it, how to break it, how to see it. None of them own the platform itself. This one does — how the substrate is architected, segmented, hardened, keyed, and kept in a known-good state.
That gap is worth naming because the most expensive cloud failures aren’t vulnerabilities in the usual sense. They’re structural: an account layout that made the blast radius the whole estate, an egress path nobody constrained, a KMS design that encrypted everything with a key any compute role could use.
Why it matters
Section titled “Why it matters”Architecture decisions are the ones you can’t patch. A misconfigured dependency is a ticket; a flat network across three environments is a two-year programme. The controls here are also the ones that make every other pillar cheaper — segmentation shrinks what a pentest can reach, sane account structure shrinks what an IAM mistake can touch, and a real posture baseline shrinks what detection has to compensate for.
The honest counterweight: posture tooling is very good at producing findings and much worse at producing prioritised ones. A CSPM that reports ten thousand issues has told you nothing, which is why this pillar leans on risk prioritization rather than restating it.
How this connects
Section titled “How this connects”- → IAM: the two-plane split. §2 owns identity policy — evaluation logic, roles, federation. This pillar owns org-level guardrail architecture: SCPs and Azure Policy as blast-radius design rather than as permission checks.
- → Application Security: §3 is the workload, this is what it runs on. IaC and container scanners live there; the posture programme they feed lives here.
- → Penetration Testing & Red Teaming: segmentation, egress control and workload isolation are exactly what an operator tests. Cloud pivots are architecture findings before they are exploits.
- → Detection Engineering: architecture determines what is observable. Network design decides whether east-west traffic is even loggable, which makes §8.2 upstream of §7.3’s coverage gaps.
- → GRC: most technical control requirements land here — encryption, segmentation, backup, key management. “Data is encrypted at rest” is an audit answer; §8.4 is what it does and doesn’t buy.
- → Threat Intelligence: posture findings are a prioritization problem before they are a remediation problem.
- → AI & Automation: drift detection and closed-loop remediation are the natural automation target, and model-serving infrastructure is just another workload with an unusual blast radius.
- → Incident Response & Digital Forensics: cloud IR is an architecture dependency. Snapshotting, credential revocation and blast-radius scoping all rest on how the substrate was built.
- → Data Security & Privacy Engineering: §8.4 owns key material and primitives; §10 owns the data itself. Encryption is the mechanism, not the control.
What’s here
Section titled “What’s here”| Subsection | Focus |
|---|---|
| Cloud Architecture & Landing Zones | Multi-account structure as blast-radius design, Organizations/Control Tower, management groups and folders, environment separation, org-level guardrails, landing zones as code |
| Network Security & Segmentation | VPC/VNet design and subnet tiering, private endpoints, egress control and DNS security, microsegmentation, mTLS and service mesh, ZTNA vs. VPN |
| Workload & Container Security | Minimal images and provenance, admission control, Kubernetes hardening, runtime security and isolation, serverless and managed-service posture, host hardening |
| Cryptography & Key Management | KMS/HSM design and key hierarchies, envelope encryption, what encryption actually defends against, secrets architecture, PKI lifecycle, post-quantum and crypto agility |
| Posture Management & IaC | What CSPM/CNAPP genuinely catches, IaC security, drift detection and closed-loop remediation, benchmarks as baselines, keeping the findings queue finite |
| Resilience & Recovery | Backup and restore as a security control, immutable and air-gapped backups, restore testing as the only real evidence, DDoS and edge protection, multi-region failover |