Library
Cloud security academy
The concepts behind cloud and Microsoft 365 security, explained in plain English: what each term means, why it matters and how it differs from its neighbours.
11terms explained
4topics
Security posture management
The tool categories behind cloud and SaaS security: what each one covers and how they differ.- Cloud Infrastructure Entitlement ManagementWhat is CIEM?Cloud Infrastructure Entitlement Management (CIEM) is the practice, and the tooling, of discovering which identities in a cloud can do what, comparing that with what they actually use, and trimming the difference. It matters because cloud permissions pile up over time, and every unused permission is access an attacker could abuse if that identity is compromised.Read →
- Cloud-Native Application Protection PlatformWhat is CNAPP?A cloud-native application protection platform (CNAPP) is a single product that combines several cloud security capabilities, typically posture management, workload protection and code or pipeline security, so that their findings can be viewed together. It matters because the same cloud environment is otherwise watched through many separate consoles, and a risk that spans settings, workloads and identities is hard to see from any one of them.Read →
- Cloud Security Posture ManagementWhat is CSPM?Cloud security posture management (CSPM) is the practice, and the class of tools, that reads the settings of your cloud accounts, compares them with a security standard and reports every place they fall short. It matters because a wrong setting is a routine way in for attackers, and no team can re-read thousands of settings by hand.Read →
- Data Security Posture ManagementWhat is DSPM?Data Security Posture Management (DSPM) is a category of tooling that finds where sensitive data lives across cloud storage and databases, then checks how exposed that data is: who can reach it, whether it is public, and how it is protected. It matters because cloud data spreads quickly into copies and forgotten stores, and you cannot protect data you do not know you have.Read →
- Identity Threat Detection and ResponseWhat is ITDR?Identity threat detection and response (ITDR) is the practice, and the class of tools, that watches how accounts are used, spots signs that an identity has been stolen or abused, and helps you contain it. It matters because attackers increasingly log in with valid credentials instead of breaking in, so settings checks alone cannot tell you that a legitimate-looking account is being misused.Read →
- SaaS Security Posture ManagementWhat is SSPM?SaaS security posture management (SSPM) is the practice of checking the security settings inside SaaS applications, such as tenant policies, sharing options and admin roles, against a standard and flagging what is off. It matters because the SaaS provider runs the application but you decide how it is configured, and those choices are easy to get wrong.Read →
Benchmarks and baselines
CIS benchmarks, profile levels and security baselines, and how they are used.- CIS BenchmarksCIS Benchmarks are free, consensus-built configuration guides from the Center for Internet Security that list, setting by setting, how a given product or cloud should be configured to be secure. They matter because they give you a neutral, widely recognised yardstick, so you do not have to invent your own list of what good looks like.Read →
- CIS Level 1 vs Level 2CIS Benchmarks group their recommendations into profiles: Level 1 is a base set that is meant to be easy to adopt with little operational impact, and Level 2 adds stricter settings for environments where security is paramount. It matters because the level decides how much hardening you apply and how much user disruption you should plan for.Read →
- Security baselineA security baseline is an agreed, documented set of configuration settings that every system of a given kind must meet, and that changes only through a controlled process. It matters because it turns "is this secure?" into a question you can answer with a yes or no per setting, and lets you notice when something departs from it.Read →
Identity and access
The identity concepts most cloud findings come back to.Running cloud security
Keeping configurations right over time: inventory, drift, remediation and the shared responsibility model.From concepts to your own configuration
ConfigCobra checks Microsoft 365, Azure, Google Cloud and AWS against the CIS benchmarks, read-only.