Cloud & containers
Misconfiguration, cross-account trust and cloud identity, container escape and Kubernetes RBAC, infrastructure as code, and what CSPM, CIEM and CNAPP cover.
CIEM
Cloud infrastructure entitlement management, or CIEM, is the analysis of who and what can do what in a cloud estate: resolving granted permissions into effective permissions, and comparing those with the permissions actually used. It is the identity side of cloud security posture, and in most estates it is where the exploitable risk sits.
Cloud attack path
In cloud security, a cloud attack path is the chain of permissions and identity relationships that leads from an attacker’s starting position to the data or control they want, one grant at a time. Presenting the result of a cloud test as this chain, rather than a list of scanner alerts, is what distinguishes it from a posture tool.
Cloud misconfiguration
In cloud security, a cloud misconfiguration is a permissive or mistaken setting that exposes resources or grants more access than intended: over-broad roles, unrestricted trust between accounts, mis-scoped identity federation and exposed storage. It is a leading cause of public-cloud compromise, and one a scanner finds long before an attacker needs an exploit.
Cloud security posture management (CSPM)
In cloud security, CSPM (cloud security posture management) is tooling that continuously checks a cloud estate for misconfigurations and policy violations against a baseline. It sits in a crowded acronym space next to CNAPP and CIEM, which vendors themselves often blur, and it is the tool whose output a client brings us to validate.
CNAPP
A cloud native application protection platform, or CNAPP, is a product category that combines posture management, workload protection, entitlement analysis and infrastructure as code scanning in one console. The term describes a packaging decision by vendors rather than a new technique, and its value is correlation across those views.
Container escape
In cloud security, a container escape is the act of breaking out of a container to gain access to the host it runs on. It is the finding that turns a compromised container into a compromised node, and it is what decides the severity of a Kubernetes assessment: contained application bug, or foothold on the underlying host.
Container image scanning
Container image scanning is the analysis of a built image against vulnerability data, to identify the known flaws in the operating system packages and application dependencies inside it. It describes the contents of the artefact at rest and tells you nothing about how that container behaves once it is running.
Cross-account trust
Cross-account trust is a configuration in which a role in one cloud account permits identities from another account to assume it. It is the intended way to separate environments and to grant a supplier access, and it is also the relationship that turns a compromise of one account into a compromise of several.
CSP (cloud service provider)
A cloud service provider is the company that supplies computing resources as a service, from raw infrastructure to fully managed applications. Where its responsibility ends and yours begins is the first question of any cloud project.
Infrastructure as code security
In cloud security, infrastructure as code security is the practice of finding and fixing misconfigurations in the templates that define cloud resources, before they are deployed. It is where a cloud misconfiguration is actually repaired durably, in the template rather than the console, and it closes the loop between a finding and a lasting fix.
Instance metadata service (IMDS)
In cloud security, the instance metadata service (IMDS) is an endpoint reachable from inside a cloud instance that returns information about it, including temporary credentials for the role attached to the instance. It is the link that turns a server-side request forgery into role credentials, and the chain that best shows why web and cloud testing belong together.
Kubernetes RBAC
In cloud security, Kubernetes RBAC is the role-based access control model that governs what users and workloads may do inside a cluster. It is where a cluster’s excessive permissions concentrate and the shortest route to cluster administrator, and it is distinct enough from generic RBAC to warrant its own entry, because the model and the findings differ.
Kubernetes security
Kubernetes security is the work of protecting a cluster and everything it runs: the control plane and its API, the permissions model that decides who may create what, the isolation between workloads, and the secrets they consume. In a cluster, the ability to create a pod is usually equivalent to control of the node.
Serverless security
Serverless security covers securing functions and managed services where the provider operates the runtime and the customer supplies only code and configuration. Patching the host stops being the customer’s problem, and identity, event input and dependencies become the whole of it.
Shared responsibility model
In cloud security, the shared responsibility model is the division of security duties between the cloud provider and the customer: the provider secures the underlying platform, and the customer secures what they build and configure on it. It is the conversation that opens every cloud project, and the misunderstanding that most often distorts an audit’s scope.