Cloud Security

---
name: cloud-security
description: "Routing agent for cloud security — CNAPP, CSPM, CWPP, CIEM, DSPM, and container/Kubernetes security. Covers shared responsibility, multi-cloud posture, cloud-native attack patterns, and tool selection across Wiz, Prisma Cloud, Orca, Defender for Cloud, and AWS Security Hub. WHEN: \"CNAPP\", \"CSPM\", \"CWPP\", \"CIEM\", \"cloud security posture\", \"cloud workload protection\", \"container security\", \"Kubernetes security\", \"cloud misconfiguration\", \"toxic combination\", \"attack path\", \"cloud security platform\". Do NOT use for platform-specific questions -- use the `wiz`, `prisma-cloud`, `orca`, `defender-cloud`, `aws-security-hub`, or `container-security` skill."
license: MIT
---

# Cloud Security

This skill covers cloud security disciplines — spanning posture management, workload protection, identity entitlements, data security posture, and container/Kubernetes security. It provides deep knowledge of the CNAPP taxonomy, shared responsibility model, cloud-native attack patterns, and the leading platforms in this space.

## When to Use This Skill vs. a Sibling Skill

**Use this skill when the question is cross-platform or conceptual:**
- "What is the difference between CSPM and CWPP?"
- "How do I choose between Wiz and Prisma Cloud?"
- "What does a CNAPP platform cover?"
- "How do I build a cloud security program from scratch?"
- "What are the most common cloud misconfigurations?"
- "Explain toxic combinations and attack paths"
- "How does shared responsibility work across AWS/Azure/GCP?"

**Read a sibling skill when the question is platform-specific:**
- "Configure Wiz policies for our AWS environment" --> `wiz`
- "Prisma Cloud alert tuning and suppression" --> `prisma-cloud`
- "Orca SideScanning coverage gaps" --> `orca`
- "Defender for Cloud secure score remediation" --> `defender-cloud`
- "AWS Security Hub finding aggregation" --> `aws-security-hub`
- "Falco rule authoring for Kubernetes" --> `falco`
- "Aqua image scanning in CI/CD" --> `aqua`
- "Sysdig runtime detection and posture" --> `sysdig`
- "Container/K8s security concepts (admission control, RBAC, network policies)" --> `container-security`

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **Posture / Compliance** -- Load `references/concepts.md` for CSPM, CNAPP taxonomy, compliance frameworks
   - **Workload / Runtime** -- Apply CWPP knowledge; read the appropriate sibling skill for tool-specific guidance
   - **Identity / Entitlements** -- Apply CIEM knowledge; reference cloud IAM attack patterns
   - **Data Security** -- Apply DSPM knowledge; discuss data discovery and exposure risk
   - **Container / Kubernetes** -- Read `container-security`
   - **Platform Selection** -- Compare platforms based on architecture, coverage, and use case
   - **Cloud Attack Patterns** -- Reference MITRE ATT&CK for Cloud; discuss kill chains

2. **Gather context** -- Which cloud providers? AWS, Azure, GCP, multi-cloud? What workload types (VMs, containers, serverless, PaaS)? Regulated industry? Existing security tooling?

3. **Analyze** -- Apply cloud-specific reasoning. Cloud attacks differ fundamentally from on-prem: identity is the perimeter, misconfigurations are the most exploited vector, lateral movement happens via IAM roles and cloud APIs.

4. **Recommend** -- Provide specific, actionable guidance with trade-offs. Cloud security tools overlap significantly — match tools to program maturity and use case.

5. **Qualify** -- State cloud provider, architecture assumptions, and areas where guidance varies by provider.

## Core Concepts

### CNAPP Taxonomy

Cloud-Native Application Protection Platform (CNAPP) is the converged platform category (Gartner, 2021) covering the full cloud application lifecycle:

| Capability | Acronym | What It Does | Typical Signals |
|---|---|---|---|
| Cloud Security Posture Management | CSPM | Detects misconfigurations in cloud resources against security benchmarks | S3 bucket public, security group 0.0.0.0/0, MFA disabled |
| Cloud Workload Protection Platform | CWPP | Protects running workloads — VMs, containers, serverless — via vulnerability scanning and runtime protection | CVEs in running images, shell spawned in container, crypto mining |
| Cloud Infrastructure Entitlement Management | CIEM | Analyzes IAM permissions, identifies over-privileged identities, net-effective permissions | IAM role with admin+, unused service account with broad access |
| Data Security Posture Management | DSPM | Discovers data stores, classifies sensitive data, identifies exposure and access paths | PII in public S3 bucket, database with no encryption, shadow data |
| Cloud Detection & Response | CDR | Real-time threat detection in cloud control plane, workload telemetry, and network traffic | Credential exfiltration, unusual API calls, lateral movement via assume-role |
| Application Security (Shift Left) | -- | IaC scanning, secrets detection, SCA in code, CI/CD integration | Terraform misconfiguration, hardcoded AWS keys in code |
| AI Security Posture Management | AI-SPM | Discovers AI/ML workloads, models, training data; identifies AI-specific risks | Exposed AI API endpoints, model data exfiltration, AI resource abuse |

**CNAPP vendors:** Wiz, Prisma Cloud (Palo Alto), Orca, Lacework, CrowdStrike Falcon Cloud Security, Defender for Cloud (partial)

### Shared Responsibility Model

| Layer | AWS Managed | Customer Managed |
|---|---|---|
| Physical / Hardware | Yes | No |
| Hypervisor / Network fabric | Yes | No |
| Managed service security (RDS, S3 service) | Yes | No |
| OS patching (EC2, self-managed) | No | Yes |
| Network configuration (VPC, Security Groups, NACLs) | No | Yes |
| Data encryption and classification | Shared (tools provided) | Yes (configuration) |
| IAM configuration and permissions | No | Yes |
| Application security | No | Yes |
| Workload runtime configuration | No | Yes |

**The critical insight:** Cloud providers secure the infrastructure; customers are responsible for everything they configure, deploy, and run on it. Most cloud breaches are caused by customer misconfigurations, not provider failures.

### Cloud Attack Patterns (MITRE ATT&CK for Cloud)

| Phase | Common Techniques | Mitigation |
|---|---|---|
| Initial Access | Phishing for cloud credentials, exploiting public-facing apps, stolen API keys, misconfigured storage | MFA, credential hygiene, CSPM for public exposure |
| Execution | Lambda abuse, EC2 user data injection, cloud function exploitation | Least privilege execution roles, code signing |
| Persistence | Creating IAM users/keys, backdoor Lambda functions, modifying cloud functions | CloudTrail monitoring, IAM change alerting, CIEM |
| Privilege Escalation | IAM policy attachment, role chaining, PassRole abuse, assume-role chains | CIEM net-effective permissions analysis, JIT access |
| Defense Evasion | Disabling CloudTrail, deleting logs, creating shadow resources in other regions | Immutable logging, GuardDuty/Defender, CDR |
| Credential Access | Stealing EC2 instance metadata (IMDS v1), secret manager scraping, lambda env vars | IMDSv2 enforcement, secrets in dedicated vaults |
| Discovery | Describing cloud resources, enumerating IAM, listing buckets | Anomaly detection, API call rate monitoring |
| Lateral Movement | Cross-account role assumption, service account pivoting | Least privilege cross-account, SCP guardrails |
| Collection | Data staging in S3, database snapshot sharing | DSPM, S3 bucket policy scanning |
| Exfiltration | Direct S3 transfer, data replication to attacker-controlled account | DSPM, network egress monitoring |
| Impact | Ransomware via S3 encryption, resource deletion, crypto mining | Immutable backups, anomaly detection, CDR |

### CSPM vs. CWPP vs. CIEM

These are the three foundational CNAPP pillars and are frequently confused:

**CSPM (Posture):**
- Checks your cloud configuration against benchmarks (CIS, NIST, SOC 2, PCI DSS)
- Answers: "Is my cloud configured securely?"
- Works agentlessly by reading cloud APIs
- Example finding: "EC2 security group allows SSH from 0.0.0.0/0"

**CWPP (Workload):**
- Protects running workloads — scans for vulnerabilities, monitors runtime behavior
- Answers: "Are my running workloads safe and are they behaving normally?"
- May require agents for runtime protection (or use agentless snapshot scanning for vuln data)
- Example finding: "Critical CVE in running container image", "Crypto miner process detected"

**CIEM (Entitlements):**
- Analyzes IAM permissions across cloud identity types (users, roles, service accounts, federated)
- Answers: "Who can do what, and is that appropriate?"
- Calculates net-effective permissions (what an identity can actually do after all policy evaluations)
- Example finding: "Lambda execution role has s3:* on all buckets; only needs GetObject on one bucket"

### Toxic Combinations and Attack Paths

A **toxic combination** is a multi-factor risk where individually acceptable conditions combine to create critical risk:

Example: `EC2 instance with critical CVE` + `IMDSv1 enabled (allows credential theft)` + `instance role with S3:* on sensitive bucket` + `S3 bucket contains PII`

No single finding is critical alone, but together they represent a complete attack path from exploitation to data breach.

**Attack path analysis** traces the full path from an internet-exposed entry point through privilege escalation to a critical asset (sensitive data, production systems). This is how Wiz's Security Graph, Prisma Cloud's attack path, and Orca's risk prioritization work.

### Platform Selection Guidance

| Criteria | Wiz | Prisma Cloud | Orca | Defender for Cloud | AWS Security Hub |
|---|---|---|---|---|---|
| Deployment model | Agentless (API) | Hybrid (agentless CSPM + Defender agents for CWPP) | Agentless (SideScan) | Agentless + Arc for multi-cloud | Agentless (AWS-native) |
| Multi-cloud | Excellent | Excellent | Good | Good (Azure-native, Arc for others) | AWS-only |
| Runtime protection | Optional sensor (Wiz Defend) | Defender agents (strong) | Limited | Strong for Defender plans | Limited |
| CNAPP completeness | Very high | Very high | High | Medium-high | Low (aggregation, not CNAPP) |
| Best fit | Large enterprise, multi-cloud, CNAPP-first | Large enterprise, agent-rich CWPP + CNAPP | Mid-market, agentless simplicity | Azure-centric organizations | AWS-native finding aggregation |
| Code security | Wiz Code (strong) | Prisma Cloud supply chain | Limited | DevOps Security | No |

## Subcategory Routing

| Request Pattern | Route To |
|---|---|
| Wiz platform, Security Graph, toxic combinations, attack paths | `wiz` |
| Prisma Cloud, Cortex Cloud, CWPP Defenders, AppDNA | `prisma-cloud` |
| Orca SideScan, Orca risk score, Orca CNAPP | `orca` |
| Defender for Cloud, secure score, Defender plans, Azure Arc | `defender-cloud` |
| AWS Security Hub, ASFF, security standards, finding aggregation | `aws-security-hub` |
| Container security, Kubernetes security, image scanning, admission control | `container-security` |
| Aqua Security, image scanning, vShield, DTA | `aqua` |
| Sysdig Secure, Falco-based runtime, CDR | `sysdig` |
| Falco, eBPF, syscall rules, Falcosidekick | `falco` |

## Reference Files

Load these when you need deep conceptual knowledge:

- `references/concepts.md` -- Cloud security fundamentals: shared responsibility, CSPM/CWPP/CIEM/DSPM/CNAPP taxonomy, cloud attack patterns, compliance frameworks. Read for "how does X work" and program-building questions.
- `container-security` -- Sibling skill for Container and Kubernetes security fundamentals: image scanning, admission control, runtime protection, RBAC, network policies, supply chain security.