CoreQ Academy4.4 Given a scenario, apply security best practices.
These are the habits that prevent most cloud incidents: least privilege, hardening against benchmarks, encryption, secrets management and secure containers and storage.
Practices
- Zero Trust
- Verify every request explicitly, use least privilege and assume breach, regardless of network location.
- Benchmark
- A published secure-configuration baseline to measure against.
- Center for Internet Security (CIS)
- CIS Benchmarks for cloud providers, operating systems and Kubernetes.
- Vendor-specific
- Provider best-practice frameworks and security baselines.
- Hardening
- Removing unneeded services, closing ports and applying secure settings.
- Patching
- Keeping OS, images and dependencies current.
- Data in transit
- Encrypt with TLS; enforce HTTPS-only access to storage and APIs.
- Data at rest
- Encrypt disks, databases, buckets and backups with managed keys.
- Secrets management
- Store passwords, keys and tokens in a vault or secrets manager, rotate them, and never commit them to code.
- API security
- Authenticate and authorise every call, validate input, rate limit, and log.
- Principle of least privilege
- Grant only the permissions needed, scoped to specific resources, reviewed regularly.
Container security
- Privileged
- Privileged containers have broad host access; avoid them because escape becomes easy.
- Unprivileged
- Run containers as non-root with dropped capabilities and read-only filesystems where possible.
- File access permissions
- Restrict which files and mounts a container can read or write.
Storage security
- Object storage
- Block public access by default, use bucket policies, encryption, versioning and access logging.
- File storage
- Restrict mounts by network and identity, encrypt and set file permissions.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.4 of the publicly available CompTIA Cloud+ CV0-004 exam objectives (Exam objectives V4, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.