Cloud Security Posture Management

The most common cause of cloud breaches is not sophisticated hacking — it is misconfiguration. Public S3 buckets, overly permissive security groups, unencrypted databases, and unused IAM credentials are the low-hanging fruit that attackers exploit. Cloud Security Posture Management (CSPM) continuously scans your cloud environments and identifies these misconfigurations before attackers find them.

---

What CSPM Monitors

Identity & Access:
  ✓ Root account usage
  ✓ IAM users without MFA
  ✓ Overly permissive policies
  ✓ Unused credentials (> 90 days)
  ✓ Cross-account access

Storage:
  ✓ Public S3 buckets
  ✓ Unencrypted storage
  ✓ No versioning enabled
  ✓ No lifecycle policies

Compute:
  ✓ Unrestricted SSH access (0.0.0.0/0:22)
  ✓ Unpatched instances
  ✓ Public IP on internal services
  ✓ No IMDSv2 enforcement

Database:
  ✓ Public endpoints
  ✓ No encryption at rest
  ✓ No automated backups
  ✓ Default credentials

Network:
  ✓ Overly permissive security groups
  ✓ No VPC flow logs
  ✓ Missing network segmentation
  ✓ Unencrypted transit

---

CSPM Tools

Tool	Type	Multi-Cloud	Best For
AWS Security Hub	Cloud-native	AWS only	AWS-centric organizations
GCP Security Command Center	Cloud-native	GCP only	GCP-centric organizations
Azure Defender for Cloud	Cloud-native	Azure + limited	Azure-centric organizations
Prisma Cloud (Palo Alto)	Commercial	AWS, GCP, Azure	Enterprise multi-cloud
Prowler	Open source	AWS, GCP, Azure	Budget-conscious, customizable
Steampipe	Open source	Multi-cloud	SQL-based querying
CloudQuery	Open source	Multi-cloud	Data pipeline approach

---

Policy-as-Code with Steampipe

-- Find public S3 buckets
SELECT
    name,
    region,
    acl ->> 'Owner' as owner
FROM aws_s3_bucket
WHERE bucket_policy_is_public = true
   OR block_public_acls = false;

-- Find IAM users without MFA
SELECT
    user_name,
    password_last_used,
    mfa_enabled
FROM aws_iam_user
WHERE mfa_enabled = false
  AND password_enabled = true;

-- Find unencrypted RDS instances
SELECT
    db_instance_identifier,
    engine,
    storage_encrypted,
    publicly_accessible
FROM aws_rds_db_instance
WHERE storage_encrypted = false
   OR publicly_accessible = true;

---

Automated Remediation

# Auto-remediate public S3 buckets
import boto3

def remediate_public_bucket(bucket_name):
    s3 = boto3.client('s3')
    
    # 1. Block public access
    s3.put_public_access_block(
        Bucket=bucket_name,
        PublicAccessBlockConfiguration={
            'BlockPublicAcls': True,
            'IgnorePublicAcls': True,
            'BlockPublicPolicy': True,
            'RestrictPublicBuckets': True
        }
    )
    
    # 2. Log the remediation
    logger.info(f"Blocked public access on bucket: {bucket_name}")
    
    # 3. Alert
    sns.publish(
        TopicArn=SECURITY_ALERTS_TOPIC,
        Subject=f"Auto-remediated: Public bucket {bucket_name}",
        Message=f"Public access blocked on {bucket_name} by CSPM auto-remediation"
    )

---

Compliance Framework Mapping

# Map CSPM checks to compliance requirements
check: "S3 bucket encryption at rest"
compliance_mappings:
  SOC2:
    criteria: "CC6.1 - Logical and physical access controls"
  PCI-DSS:
    requirement: "3.4 - Render PAN unreadable"
  HIPAA:
    safeguard: "164.312(a)(2)(iv) - Encryption"
  ISO-27001:
    control: "A.10.1.1 - Cryptographic controls"
  NIST-800-53:
    control: "SC-28 - Protection of information at rest"

---

Anti-Patterns

Anti-Pattern	Consequence	Fix
Manual security reviews only	Findings stale within hours	Continuous CSPM scanning
Alert fatigue (1000+ findings)	Critical issues buried in noise	Prioritize by severity + exploitability
No auto-remediation	Findings open for weeks	Auto-remediate low-risk issues
Single cloud tool for multi-cloud	Gaps in coverage	Multi-cloud CSPM or cloud-native per provider
CSPM without context	All findings treated equally	Risk-based prioritization (internet-facing first)

CSPM is the immune system for your cloud environments. It does not prevent all attacks, but it ensures the most common and preventable vulnerabilities are found and fixed continuously.