Cloud Security Gaps หลัก
- Visibility Gap: ไม่เห็น Data/Workloads ใน Cloud (Shadow IT)
- Data Protection Gap: Encryption, DLP, Classification ขาดหายไป
- Access Control Gap: Over-permissioned IAM, No MFA, Static Keys
- Network Security Gap: No Micro-segmentation, Open Security Groups
- Monitoring Gap: Logs ไม่ครบ, No SIEM Integration, Alert Fatigue
- Compliance Gap: ไม่ผ่าน Standard (PCI, HIPAA, GDPR)
วิธีแก้ไข (Remediation)
1. Identity & Access (IAM)
- Enforce MFA ทุก User/Service Account
- Least Privilege + Just-in-Time Access (PIM/PAM)
- Rotate/Eliminate Long-lived Keys (ใช้ IAM Roles, Workload Identity)
- Conditional Access Policies (Location, Device, Risk)
2. Network Security
- VPC/VNet Design: Public/Private Subnets, NAT Gateway
- Security Groups / NSGs: Default Deny, Allow Specific Only
- Network Firewall (AWS Network Firewall, Azure Firewall, GCP Firewall)
- Private Link / Private Endpoints (No Internet Egress)
- WAF (Web Application Firewall) สำหรับ Public Apps
3. Data Protection
- Encryption at Rest (Default KMS/CMK) + In Transit (TLS 1.3)
- DLP Policies (Data Classification, Exfil Prevention)
- Backup & Immutable Snapshots (Ransomware Protection)
- Secrets Management (Vault, Key Vault, Secrets Manager)
4. Detection & Response
- Cloud-native SIEM (Sentinel, Security Hub, Chronicle)
- CSPM (Cloud Security Posture Management) - Misconfig Detection
- CWPP (Cloud Workload Protection) - Runtime Protection
- CDR (Cloud Detection & Response) - Threat Hunting
- Automated Remediation (SOAR, Lambda/Functions/Runbooks)
5. Governance & Compliance
- Policy as Code (OPA, Sentinel, Config Rules)
- Continuous Compliance Monitoring
- Offboarding Process: Revoke Access Immediately
- Security Training (Phishing, Cloud-specific Threats)
Shared Responsibility Model
Cloud Provider: Security OF the Cloud (Physical, Network, Hypervisor)
Customer: Security IN the Cloud (Data, Identity, Apps, Config, Network Controls)
