Preface |
|
vii | |
|
1 Security in the Modern Organization |
|
|
1 | (18) |
|
1.1 Why Security Is Critical |
|
|
1 | (2) |
|
1.2 What Is Meant by Cloud Native Security? |
|
|
3 | (2) |
|
1.3 Where Security Fits in the Modern Organization |
|
|
5 | (2) |
|
1.4 The Purpose of Modern Security |
|
|
7 | (1) |
|
|
7 | (5) |
|
1.6 How to Measure the Impact of Security |
|
|
12 | (2) |
|
1.7 The Principles of Security |
|
|
14 | (5) |
|
2 Setting Up Accounts and Users |
|
|
19 | (44) |
|
2.1 Scalable Project Structures on GCP |
|
|
19 | (8) |
|
2.2 Scalable Account Structures on AWS |
|
|
27 | (8) |
|
2.3 Scalable Subscription Structures on Azure |
|
|
35 | (5) |
|
2.4 Region Locking on GCP |
|
|
40 | (3) |
|
2.5 Region Locking on AWS |
|
|
43 | (4) |
|
2.6 Region Locking on Azure |
|
|
47 | (2) |
|
2.7 Centralizing Users on GCP |
|
|
49 | (5) |
|
2.8 Centralizing Users on AWS |
|
|
54 | (4) |
|
2.9 Centralizing Users on Azure |
|
|
58 | (5) |
|
3 Getting Security Visibility at Scale |
|
|
63 | (60) |
|
3.1 Building a Cloud Native Security Operations Center on GCP |
|
|
64 | (7) |
|
3.2 Building a Cloud Native Security Operations Center on AWS |
|
|
71 | (4) |
|
3.3 Building a Cloud Native Security Operations Center on Azure |
|
|
75 | (3) |
|
3.4 Centralizing Logs on GCP |
|
|
78 | (4) |
|
3.5 Centralizing Logs on AWS |
|
|
82 | (6) |
|
3.6 Centralizing Logs on Azure |
|
|
88 | (6) |
|
3.7 Log Anomaly Alerting on GCP |
|
|
94 | (4) |
|
3.8 Log Anomaly Alerting on AWS |
|
|
98 | (4) |
|
3.9 Log Anomaly Alerting on Azure |
|
|
102 | (4) |
|
3.10 Building an Infrastructure Registry on GCP |
|
|
106 | (4) |
|
3.11 Building an Infrastructure Registry on AWS |
|
|
110 | (8) |
|
3.12 Building an Infrastructure Registry on Azure |
|
|
118 | (5) |
|
|
123 | (58) |
|
4.1 Encrypting Data at Rest on GCP |
|
|
124 | (5) |
|
4.2 Encrypting Data at Rest on AWS |
|
|
129 | (8) |
|
4.3 Encrypting Data at Rest on Azure |
|
|
137 | (6) |
|
4.4 Encrypting Data on GCP with Your Own Keys |
|
|
143 | (4) |
|
4.5 Encrypting Data on AWS with Your Own Keys |
|
|
147 | (4) |
|
4.6 Encrypting Data on Azure with Your Own Keys |
|
|
151 | (5) |
|
4.7 Enforcing In-Transit Data Encryption on GCP |
|
|
156 | (4) |
|
4.8 Enforcing In-Transit Data Encryption on AWS |
|
|
160 | (2) |
|
4.9 Enforcing In-Transit Data Encryption on Azure |
|
|
162 | (3) |
|
4.10 Preventing Data Loss on GCP |
|
|
165 | (5) |
|
4.11 Preventing Data Loss on AWS |
|
|
170 | (4) |
|
4.12 Preventing Data Loss on Azure |
|
|
174 | (7) |
|
|
181 | (96) |
|
5.1 Networking Foundations on GCP |
|
|
182 | (6) |
|
5.2 Networking Foundations on AWS |
|
|
188 | (7) |
|
5.3 Networking Foundations on Azure |
|
|
195 | (8) |
|
5.4 Enabling External Access on GCP |
|
|
203 | (5) |
|
5.5 Enabling External Access on AWS |
|
|
208 | (6) |
|
5.6 Enabling External Access on Azure |
|
|
214 | (5) |
|
5.7 Allowing Access to Internal Resources on GCP |
|
|
219 | (6) |
|
5.8 Allowing Access to Internal Resources on AWS |
|
|
225 | (6) |
|
5.9 Allowing Access to Internal Resources on Azure |
|
|
231 | (5) |
|
5.10 Controlling External Network Connectivity on GCP |
|
|
236 | (7) |
|
5.11 Controlling External Network Connectivity on AWS |
|
|
243 | (8) |
|
5.12 Controlling External Network Connectivity on Azure |
|
|
251 | (6) |
|
5.13 Private Application Access on GCP |
|
|
257 | (8) |
|
5.14 Private Application Access on AWS |
|
|
265 | (7) |
|
5.15 Private Application Access on Azure |
|
|
272 | (5) |
|
|
277 | (64) |
|
6.1 Building Secure Infrastructure Defaults on GCP |
|
|
278 | (4) |
|
6.2 Building Secure Infrastructure Defaults on AWS |
|
|
282 | (6) |
|
6.3 Building Secure Infrastructure Defaults on Azure |
|
|
288 | (6) |
|
6.4 Functions as a Service on GCP |
|
|
294 | (5) |
|
6.5 Functions as a Service on AWS |
|
|
299 | (4) |
|
6.6 Functions as a Service on Azure |
|
|
303 | (6) |
|
6.7 Robust Deployment on GCP |
|
|
309 | (5) |
|
6.8 Robust Deployment on AWS |
|
|
314 | (8) |
|
6.9 Robust Deployment on Azure |
|
|
322 | (7) |
|
6.10 Deployment at Scale on GCP |
|
|
329 | (2) |
|
6.11 Deployment at Scale on AWS |
|
|
331 | (5) |
|
6.12 Deployment at Scale on Azure |
|
|
336 | (5) |
|
|
341 | (66) |
|
7.1 Labeling Resources on GCP |
|
|
342 | (5) |
|
7.2 Tagging Resources on AWS |
|
|
347 | (5) |
|
7.3 Tagging Resources on Azure |
|
|
352 | (5) |
|
7.4 Detecting Noncompliant Infrastructure on GCP |
|
|
357 | (7) |
|
7.5 Detecting Noncompliant Infrastructure on AWS |
|
|
364 | (5) |
|
7.6 Detecting Noncompliant Infrastructure on Azure |
|
|
369 | (6) |
|
7.7 Preventing Noncompliant Infrastructure on GCP |
|
|
375 | (4) |
|
7.8 Preventing Noncompliant Infrastructure on AWS |
|
|
379 | (4) |
|
7.9 Preventing Noncompliant Infrastructure on Azure |
|
|
383 | (5) |
|
7.10 Remediating Noncompliant Infrastructure on GCP |
|
|
388 | (8) |
|
7.11 Remediating Noncompliant Infrastructure on AWS |
|
|
396 | (4) |
|
7.12 Remediating Noncompliant Infrastructure on Azure |
|
|
400 | (7) |
|
8 Providing Internal Security Services |
|
|
407 | (54) |
|
8.1 Protecting Security Assets and Controls on GCP |
|
|
408 | (4) |
|
8.2 Protecting Security Assets and Controls on AWS |
|
|
412 | (5) |
|
8.3 Protecting Security Assets and Controls on Azure |
|
|
417 | (5) |
|
8.4 Understanding Machine Status at Scale on GCP |
|
|
422 | (4) |
|
8.5 Understanding Machine Status at Scale on AWS |
|
|
426 | (4) |
|
8.6 Understanding Machine Status at Scale on Azure |
|
|
430 | (5) |
|
8.7 Patching at Scale on GCP |
|
|
435 | (4) |
|
8.8 Patching at Scale on AWS |
|
|
439 | (3) |
|
8.9 Patching at Scale on Azure |
|
|
442 | (5) |
|
|
447 | (4) |
|
|
451 | (5) |
|
8.12 Data Backup on Azure |
|
|
456 | (5) |
|
|
461 | (22) |
|
9.1 Enabling Project Sharing on GCP |
|
|
462 | (3) |
|
9.2 Enabling Account Sharing on AWS |
|
|
465 | (3) |
|
9.3 Enabling Resource Group Sharing on Azure |
|
|
468 | (4) |
|
9.4 Application Security Scanning on GCP |
|
|
472 | (3) |
|
9.5 Application Security Scanning on AWS |
|
|
475 | (4) |
|
9.6 Application Security Scanning on Azure |
|
|
479 | (4) |
|
10 Security in the Future |
|
|
483 | (6) |
|
|
484 | (1) |
|
|
485 | (1) |
|
10.3 Building Situational Awareness |
|
|
486 | (2) |
|
|
488 | (1) |
|
|
489 | (2) |
|
11.1 Authenticating with GCP |
|
|
490 | (1) |
|
11.2 Authenticating with AWS |
|
|
490 | (1) |
|
11.3 Authenticating with Azure |
|
|
490 | (1) |
Index |
|
491 | |