Cloud security and compliance hardening
I have looked at infrastructure with security in mind since building a Slackware-based security distribution with friends in the early 2000s, so I build it in from the start of a project instead of leaving it for the end.
Scope
What I take on
The edge
AWS WAF, CloudFront and Shield in front of public-facing load balancers, which closes off the part of the estate the internet can actually reach.
Containers
Migrating production workloads to distroless images, so a compromised container has no shell, no package manager and very little to work with.
Shift-left scanning
SonarCloud, Trivy and OWASP ZAP wired into the build, so findings arrive while the code is still fresh instead of in a quarterly report.
Evidence for auditors
Automated compliance reporting and ownership data, so an audit becomes a document you generate instead of a project you staff.
Network security
Segmentation, VPN estates on pfSense, WireGuard or OpenVPN, and the Cisco background to go with it (CCNA and Cisco Security Green Belt).
Method
How it runs
-
01
Fix the reachable surface first
Effort goes where an attacker can actually get in. The public edge and the container runtime come before the theoretical risks further down the list.
-
02
Make the secure path the easy path
Controls developers have to remember get skipped under deadline. Controls built into the pipeline and the base image do not.
-
03
Produce evidence as a by-product
In regulated environments, running the control is half the work and proving it ran is the other half. Both should be automatic.
Evidence
Where I have done this before
- Knab Inside a Dutch bank, moved 34 production services to distroless images, cutting reported vulnerabilities from thousands to under 20, and put AWS WAF, CloudFront and Shield in front of the 3 customer identity endpoints.
- Knab, pipelines Integrated SonarCloud, Trivy and OWASP ZAP scanning into Azure DevOps builds to shift security left, and automated the change-management trail around releases.
- Cisco, via 3Pillar Global Python automation for Cisco FirePower next-generation firewalls, working on the security tooling itself.
Fit
Probably worth a conversation if
- You are regulated and an audit is coming.
- Your public endpoints have no WAF in front of them, and you know it.
- Your container images are inherited, enormous and full of things you do not ship.
- Security findings arrive as a PDF once a quarter instead of in the pipeline.
Contact
Tell me what is actually broken
The contact details live on the front page. If I am not the right person for this, I will say so.