Cloud omgevingen veranderen snel: permissies, storage policies, API keys en service principals lopen vaak uit de pas met de "intended" security baseline. Dat leidt tot data exposure of privilege escalation.
Typische signalen
- Public buckets/containers, overly broad IAM roles, exposed keys
- Nieuwe external sharing links, mislukte CA/MFA enforcement
- Onverwachte API calls (enumeration), anomalous role assumptions
Actueelheidscheck
- Guardrails: CSPM + IaC scanning + policy-as-code (deny by default)
- Secrets hygiene: short-lived creds, vaulting, key rotation, workload identity
- Logging: cloud trail, IdP logs, SaaS audit logs centraal correleren
