Seven Layers of Cloud Defense: How Organizations Apply Defense in Depth
Summary
A practical cloud-security explainer describes seven defense-in-depth layers, from filtering traffic and managing identities to isolating workloads, protecting secrets, and securing data.
Key points
- The article presents seven layers: edge traffic controls, identity and access, API security, network segmentation, workload security, secrets management, and data protection.
- Recommended edge controls include WAFs, DDoS protection, rate limits, and bot controls; API safeguards include schema and signature validation, authorization, and IP restrictions.
- Use managed or workload identities where possible, remove unnecessary long-lived credentials, and limit permissions to required resources.
- Segment cloud networks so that compromising an internet-facing component does not automatically provide access to applications or databases.
- Harden and scan approved workload images, and assume a compromised workload may expose accessible credentials or secrets.
- Store secrets outside code and configuration, restrict which workloads can retrieve them, and rotate credentials.
- Encrypt data at rest and in transit, restrict who can read or modify it, and consider application-level or end-to-end encryption where intermediaries terminate TLS.
Article Details
- Topic
- Seven layers of defense in depth for cloud infrastructure and data
MITRE ATT&CK
T1110.004 · Credential StuffingThe article describes credential stuffing with leaked credentials as an attack against internet-facing applications.T1552.001 · Credentials In FilesDuring an authorized security assessment, Kushal found a hardcoded database credential in an XML file and used it to access the database.