Cybersecurity area
Cloud Security
Cloud Security protects cloud services, SaaS applications, workloads, identities, configurations, and data across hybrid and multicloud environments.
Acronym Glossary
This glossary explains acronyms used in this part so the intended security function is clear.
- CASB
- Cloud Access Security BrokerA security control layer between users and cloud applications that helps enforce access policies and protect data in SaaS.
- CSPM
- Cloud Security Posture ManagementContinuous assessment of cloud configurations, services, and settings against security and compliance requirements.
- CWPP
- Cloud Workload Protection PlatformProtection for cloud workloads such as virtual machines, containers, Kubernetes, and serverless components.
- CIEM
- Cloud Infrastructure Entitlement ManagementAnalysis and control of cloud permissions, roles, and excessive privileges in cloud infrastructure.
- CNAPP
- Cloud-Native Application Protection PlatformA platform combining multiple cloud security layers, typically posture, workloads, identity, vulnerabilities, and application context.
- CDR
- Cloud Detection and ResponseDetection and response across cloud events, identities, workloads, and SaaS activity. This is not Content Disarm and Reconstruction.
What This Area Covers
Cloud Security covers environments that no longer live only in the local data center. It includes SaaS applications, cloud accounts, containers, virtual machines, serverless services, identities, permissions, configurations, data flows, and links to development processes. The main challenge is the speed of change: new services appear continuously, teams use multiple platforms, and the boundary between infrastructure, application, and identity becomes blurred.
Why It Matters
A well-designed cloud security architecture helps reveal misconfigurations, excessive permissions, exposed storage, risky workloads, and events that may indicate compromise. The customer often does not need another isolated tool, but a clear view of which risk layer is uncovered: SaaS control, posture, workload protection, identity entitlement, cloud detection and response, or audit.
How To Navigate This Area
When selecting cloud security technologies, it is important to distinguish SaaS control, workload protection, permissions, configuration governance, data protection, and continuous event detection. The market is moving toward CNAPP, CDR, and cloud risk management, but practical value depends on integration with DevOps, IAM, SIEM/SOAR, and risk prioritization.
When mapping solutions, prevention, compliance, risk management, and detection should be separated. CSPM and Posture show configuration state, CWPP protects workloads, CIEM analyzes permissions, CDR handles cloud detection and response, and CNAPP tries to combine several layers into one platform. Vendor selection depends on whether the organization mainly has a SaaS problem, multicloud infrastructure, containers, cloud identities, or a need for unified cloud risk management.
The technology list below works as a map of the Cloud Security area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.
Technical Section Schema
Questions To Ask When Selecting A Solution
- Which cloud platforms and SaaS applications are critical for the organization?
- Is the main issue configuration, workload, identity, data, or incident detection?
- Should the solution also cover containers, serverless, DevOps pipelines, or only operational cloud controls?
- Should the solution reduce the number of consoles or fill a specific control gap?
- Can the tool work with existing SIEM, IAM, DevOps, ticketing, and risk reporting processes?
How To Use This Section
Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.
Vendors From The SecTec Portfolio
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
- Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
- Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
- Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
- Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
- Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
- Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
- Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
- Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
- Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
- Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
- SSRF – Server-Side Request ForgeryAn adversary causes a server or API to fetch an attacker-controlled address and reaches internal services, cloud metadata, or protected network targets.
- API security misconfiguration and exposed interfacesInsecure defaults, debug endpoints, broken CORS, verbose errors, or missing security headers expose data and functionality to an adversary.
- Shadow and zombie APIs without managed inventoryUnknown, forgotten, or outdated API versions remain reachable without current controls, ownership, documentation, and monitoring.
- Session and access-token hijackingAn adversary steals a cookie, OAuth token, or another session artifact and accesses a service without re-entering a password or MFA.
Relevant ATT&CK techniques
- T1059 · Command and Scripting InterpreterDetect, Prevent, Respond, Validate
- T1069 · Permission Groups DiscoveryDetect, Prevent, Respond
- T1078 · Valid AccountsDetect, Prevent, Respond, Validate
- T1098 · Account ManipulationDetect, Prevent, Respond, Validate
- T1105 · Ingress Tool TransferDetect, Prevent, Respond, Validate
- T1114 · Email CollectionDetect, Prevent, Respond
- T1136 · Create AccountDetect, Prevent, Respond, Validate
- T1190 · Exploit Public-Facing ApplicationDetect, Prevent, Respond, Validate
- T1213 · Data from Information RepositoriesDetect, Prevent, Respond
- T1484 · Domain or Tenant Policy ModificationDetect, Prevent, Respond, Validate
- T1526 · Cloud Service DiscoveryDetect, Respond, Validate
- T1530 · Data from Cloud StorageDetect, Prevent, Respond
- T1556 · Modify Authentication ProcessDetect, Prevent, Respond
- T1567 · Exfiltration Over Web ServiceDetect, Prevent, Respond
- T1578 · Modify Cloud Compute InfrastructureDetect, Prevent, Respond, Validate
- T1580 · Cloud Infrastructure DiscoveryDetect, Prevent, Respond, Validate
- T1685 · Disable or Modify ToolsDetect, Prevent, Respond, Validate