Cloud Governance

Stories on Cloud Governance by Teri Radichel

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Part of my series on Automating Cybersecurity Metrics. The Code.

🔒 Related Stories: Multicloud Security | Data Breaches | Cloud Governance

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Cloud Governance is one of the most critical things you can do to prevent data breaches in your cloud accounts. But you must do it in a manner that actually prevents attacks. Stop writing paper polices and automate your governance. Allow your governance team to develop and deploy the rules. New tools from cloud providers make this much easier than it has been in the past.

Use a proper Software Development Lifecycle (SDLC) that includes separate development, QA, and operations or production teams for governance code. Use separation of duties to design architectures that require multiple parties to take an action to help prevent egregious misconfiguration and limit the blast radius should an administrators credentials get compromised.

Stop Writing Paper Policies

A Cloud Security Center of Excellence

Letting Governance Teams Govern

Defining AWS Accounts and Organizational Units

Governance Foundations in the Cloud

Cloud Governance

Security Teams are Not Enforcers

Cloud Governance on AWS

AWS Organizations

Automated AWS Organization Creation

AWS Service Control Policies

Creating an AWS Governance Account

Delegated Administrator for AWS Organizations

Had some issues with AWS Organizations and Control Tower. Some of this has been resolved, but not all.

Wishlist for Cloud Governance

The chapters not published in my blog that are in my book — Cybersecurity for Executives in the Age of Cloud.

Cybersecurity for Executives in the Age of Cloud

Most of my blog series on automating cybersecurity metrics has an element of Cloud Governance to it:

Automating Cybersecurity Metrics (ACM)

GitHub — tradichel/SecurityMetricsAutomation

Naming conventions for AWS resources in an organization.

AWS Resources Organization and Naming Conventions

Tags are useful for tracking resources on AWS, but also come with some caveats. Hint: Automate tags and lock them down if you are counting on them.

Tags on AWS for Governance, Security, and Cost Allocation

Autoamted VPC Flow Logs Governance

VPC Flow Logs Governance

I opted to remove or decommission AWS Control Tower in favor of more customized governance and SCPs I can better control.

Remove AWS Control Tower

At some point I started over without Control Tower, creating a new AWS account from scratch but can reuse a lot of the elements I had already created to improve governance in AWS. This post covers some of the elements and proceed from there to see how they are used in the new AWS Organization structure.

Baking Security In From the Ground Up on AWS

Increase the number of accounts you can have in an organization:

Increase AWS Organizations Account Limit

On closing and migrating accounts:

Closing An AWS Account Associated With AWS Control Tower

AWS Organizations Close Account Constraint

SCP to Allow Closing and Removing AWS Accounts — Part 3

Close an AWS Account in an Organization

Governance for Executives, risk management, policies, and exceptions

Cybersecurity policies that reduce risk

Security exceptions are the norm

Manage your data like you manage your money

Measuring Security

A Value-Based Approach to Cybersecurity Metrics

Root OU Service Control Policies

AWS Service Control Policy Architecture

Programmatic Governance in AWS

Creating an Organizational Unit (OU) and Service Control Policies (SCPs) with CloudFormation

Enabling Cost and Usage

SCP to Allow Closing and Removing AWS Accounts — Part 1

Setting up a User and Role for Domain Name Administration

Analyzing CloudTrail Requests Related to SCPs

Generic Scripts For Deploying an Organization, Environments, and Applications

Organization-Environment Naming Convention on AWS

Adding Environments to An AWS Infrastructure Naming Convention

Why I Am Not Using AWS Organizational Unit for My Environment Name

KMS Keys for AWS Organizations Environments

Repository Accounts and Administrators

The Importance of Parameter Management in Cybersecurity and Application Security

Deployment systems — danger or defense?

It’s Friday.

Structuring Accounts For A Common Job Execution Framework

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab