Tech Due Diligence SEC-8: Cloud Security and Network Architecture

Build a secure network architecture from the start. Use VPCs with public and private subnets. Databases, application servers, and internal services belong in private subnets. Only load balancers and bastion hosts should sit in public subnets. Apply network ACLs and security groups following least privilege. Keep security group and firewall rules tight. Each group should allow only the specific ports and source IP ranges required for its function. Document the purpose of every rule. Audit regularly and remove anything no longer needed. Never allow 0.0.0.0/0 access to anything except public-facing load balancers on ports 80 and 443. Get IAM right: use individual IAM users (no shared accounts), require MFA for all console access, enforce least privilege on all policies, use IAM roles rather than long-lived access keys for service-to-service authentication, implement permission boundaries, and regularly audit for unused permissions. Lock down cloud storage. Make sure no buckets are publicly accessible unless they are intentionally serving public content. Enable server-side encryption, turn on access logging, block public access at the account level, and version important data for recovery. Centralise cloud audit logging. Configure CloudTrail (AWS), Activity Log (Azure), or Audit Logs (GCP) to capture all API calls and store them in a tamper-resistant location. Set up alerts for high-risk activities like root account usage, IAM policy changes, and security group modifications. Run cloud security posture management (CSPM) tools on a regular schedule. AWS Security Hub, Azure Defender for Cloud, or third-party tools like Prowler and ScoutSuite automatically assess your configuration against security benchmarks and surface misconfigurations. Separate your environments into different accounts. Use distinct AWS accounts or Azure subscriptions for production, staging, and development. This limits blast radius and provides clean access control boundaries.