Cloud security and compliance hardening
Security has been the lens I look at infrastructure through since building a Slackware-based security distribution with friends in the early 2000s. It is not a phase at the end of a project.
Scope
What I take on
The edge
AWS WAF, CloudFront and Shield in front of public-facing load balancers — closing off the part of the estate the internet can actually reach.
Containers
Migrating production workloads to distroless images, so a compromised container has no shell, no package manager and very little to work with.
Shift-left scanning
SonarCloud, Trivy and OWASP ZAP wired into the build, so findings arrive while the code is still fresh rather than in a quarterly report.
Evidence for auditors
Automated compliance reporting and ownership data, so an audit becomes a document you generate instead of a project you staff.
Network security
Segmentation, VPN estates on pfSense, WireGuard or OpenVPN, and the Cisco background to go with it — CCNA and Cisco Security Green Belt.
Method
How it runs
-
01
Fix the reachable surface first
Effort goes where an attacker can actually get. The public edge and the container runtime before the theoretical risks further down the list.
-
02
Make the secure path the easy path
Controls developers have to remember get skipped under deadline. Controls built into the pipeline and the base image do not.
-
03
Produce evidence as a by-product
In regulated environments the control is only half the work — proving it ran is the other half. Both should be automatic.
Evidence
Where this has been done before
- Knab Migrated public-facing load balancers behind AWS WAF, CloudFront and Shield, and hardened the container estate by moving production workloads to distroless images — inside a Dutch bank.
- Knab — pipelines Integrated SonarCloud, Trivy and OWASP ZAP scanning into Azure DevOps builds to shift security left, and automated the change-management trail around releases.
- Cisco, via 3Pillar Global Python automation for Cisco FirePower next-generation firewalls — security tooling from the inside.
Fit
Probably worth a conversation if
- You are regulated, and an audit is coming.
- Your public endpoints have no WAF in front of them and you know it.
- Container images are inherited, enormous, and full of things you do not ship.
- Security findings arrive as a PDF once a quarter instead of in the pipeline.
Contact
Tell me what is actually broken
The contact details live on the front page. If I am not the right person for this, I will say so.