# How Is Enterprise System and Cloud Security Managed? Hardening, Monitoring and Security Validation

**URL:** https://securesys.com.tr/en/learning/system-cloud-security/managing-enterprise-system-and-cloud-security

![How Is Enterprise System and Cloud Security Managed? Hardening, Monitoring and Security Validation](/images/bilgi-merkezi/covers/cover-sistembulut-12.webp)

An organisation holding security controls and holding a secure system and cloud architecture are not the same thing.

There can be a firewall.

There can be EDR.

There can be a SIEM.

There can be CSPM.

There can be PAM.

There can be backup.

Cloud provider native security services can be used.

But if these controls work disconnected from one another, the real security level can be lower than expected.

Because modern attacks do not stay in a single layer.

An attacker can first compromise a user account.

They can then try privilege escalation through Microsoft 365 or Entra ID.

They can use cloud IAM privileges.

They can move to a Kubernetes workload.

From there they can obtain a secret.

They can reach the database.

They can target the backup system.

**Corporate system and cloud security** must therefore be managed on a lifecycle basis, not a product basis.

The basic model must be thought of as follows:

**Discover → Harden → Control Access → Monitor → Detect → Respond → Recover → Validate → Improve**

This approach does not merely provide technical security.

It also forms a sustainable **system & cloud security operating model**.

#### What Is Corporate System and Cloud Security?

Corporate system and cloud security means managing the systems in on-premise, hybrid and cloud infrastructures with central security principles.

This scope covers areas such as;

- Windows and Linux systems,
- Active Directory,
- Microsoft 365 and Entra ID,
- AWS, Azure and Google Cloud,
- IAM and privileged access,
- containers and Kubernetes,
- databases,
- backup and disaster recovery,
- CSPM, CWPP and CNAPP,
- SIEM, EDR/XDR and SOC.

All of these are in scope.

The aim is not to protect each of these systems separately but to manage the trust relationships and attack paths between them together.

### Why Must System and Cloud Security Be Managed Centrally?

Because the attacker does not move according to the organisation chart.

The security team is one thing.

The cloud team another.

The network team another.

The database team another.

But for the attacker these are merely different attack steps.

For example:

Phishing

↓

Endpoint Compromise

↓

Credential Theft

↓

Active Directory

↓

Cloud SSO

↓

Cloud IAM

↓

Storage

↓

Sensitive Data

This chain can fall under the responsibility of five different teams.

But from the attacker's perspective it is a single attack.

The organisation must therefore see security end to end too.

### The First Step: Asset Inventory

The first step of a security programme is knowing what you own.

The organisation must be able to answer these questions:

How many Windows Servers are there?

How many Linux Servers?

How many Domain Controllers?

How many cloud accounts, subscriptions or projects?

How many public IPs?

How many Kubernetes clusters?

How many databases?

How many backup repositories?

How many privileged accounts?

Without this information the security programme begins incomplete.

### Why Is Asset Inventory Difficult?

Modern infrastructures are not static.

A new VM is created.

A container lives a few minutes.

A serverless function is deployed.

A new SaaS service is used.

A new cloud account is opened.

A CMDB alone may therefore not be enough.

The inventory must be kept current continuously with cloud APIs, CSPM, EASM and discovery mechanisms.

### What Are Shadow IT and Shadow Cloud?

They are services used without central IT's knowledge.

A team can open a cloud account with its own credit card, for instance.

Another team can use a different SaaS platform.

If the security team does not know about that structure;

logging,

MFA,

backup,

security policy

cannot be applied.

Asset discovery and cloud governance must therefore be carried out together.

### Why Does Asset Ownership Matter?

When a finding is detected this question must be answered immediately:

#### Whose system is this?

If the owner is unclear, remediation is delayed.

For every critical asset;

an application owner,

a technical owner,

a business owner

must be defined.

That information speeds up risk management.

### What Is Asset Criticality?

All systems are not equally important.

For example:

A test server.

The corporate blog.

ERP.

The payment system.

Active Directory.

Their business impact differs.

Every asset can therefore be classified as;

Critical,

High,

Medium,

Low

and similar.

That classification determines security priority.

### What Are Crown Jewels?

They are the organisation's critical systems whose compromise or interruption would create the highest impact.

For example;

Active Directory,

the customer database,

the payment system,

ERP,

backup management,

the identity platform

can be assessed as crown jewels.

The security programme must reduce the attack paths reaching those assets in particular.

### What Is a Security Baseline?

A **security baseline** is the minimum security standard for a particular system or platform.

For Windows Server, for instance;

RDP policy,

Windows Firewall,

audit settings,

EDR,

local admin policy

can be defined.

For cloud;

MFA,

logging,

encryption,

network exposure,

IAM

rules can be determined.

A security baseline provides standardisation.

### The Difference Between Baseline and Hardening

Baseline:

**Defines how it must be.**

Hardening:

**Brings the system to that security level.**

The baseline says, for instance:

“SSH is only reachable from the management network.”

The hardening work:

Brings the existing SSH access into line with that rule.

### How Must the CIS Benchmark Be Used?

CIS Benchmarks are one of the important references for secure configuration.

Windows.

Linux.

AWS.

Azure.

Google Cloud.

Kubernetes.

Database.

They can be used for many technologies.

But the benchmark must not be applied automatically.

Every control must be assessed in terms of;

application compatibility,

business need,

operational impact.

### Is a Security Baseline a One-Off?

No.

New technology arrives.

A new threat emerges.

A new regulation appears.

A new application dependency forms.

The baseline must therefore be versioned and updated regularly.

### How Is Configuration Drift Managed?

A system can comply with the baseline today.

Tomorrow an administrator opens a temporary firewall rule.

A month later it is forgotten.

That is drift.

Therefore;

configuration management,

CSPM,

policy enforcement,

compliance scanning

must be used.

The aim is to measure the difference between the baseline and the real environment continuously.

### How Must the Hardening Process Be Managed?

The general approach:

#### Discover

Find the systems.

#### Classify

Determine role and criticality.

#### Baseline

Choose the standard.

#### Assess

Measure the current configuration.

#### Harden

Apply the fixes.

#### Validate

Verify that the application works.

#### Monitor

Watch for drift.

This cycle continues constantly.

### How Must Patch Management Be Integrated?

Hardening is not enough on its own.

If the system is not current, new vulnerabilities can create attack surface.

The patch process must be prioritised together with;

asset criticality,

internet exposure,

exploit availability,

business impact.

This is the **risk-based patch management** approach.

### How Do Vulnerability Management and Hardening Work Together?

Vulnerability management:

Finds known security flaws.

Hardening:

Fixes wrong or weak configuration.

For example:

There is no CVE.

But RDP is open to the internet.

A vulnerability scanner may not see that as critical.

But from a hardening perspective it is a serious risk.

The two processes must therefore work together.

### What Is Risk-Based Vulnerability Management?

Not every CVE holds the same priority.

For example:

A critical CVE.

But in a test environment, on a private network.

On another system a High CVE.

But public and production.

The real risk can be higher on the second system.

Therefore;

CVSS,

EPSS,

Known Exploited Vulnerabilities,

exposure,

asset criticality

must be assessed together.

### Why Is IAM at the Centre of System and Cloud Security?

Because the large part of modern attacks can advance through valid identities.

An admin account.

A service account.

A cloud role.

An API key.

A session token.

If one of these is compromised, the attacker can act without using an exploit.

Identity security therefore sits at the centre of the whole security architecture.

### How Must Least Privilege Be Applied Across the Organisation?

Every user, service and workload must hold only the privilege they need.

This is the same principle for;

Windows local admin,

Domain Admin,

cloud IAM,

database roles,

Kubernetes RBAC,

backup admin.

The approach:

#### Minimum Privilege, Maximum Accountability

must be applied.

### Why Is Privileged Access Management a Common Layer?

All critical systems hold privileged access.

Domain Admin.

Cloud Owner.

Database DBA.

Kubernetes cluster-admin.

Backup Administrator.

Although these are different technologies, the common problem is the same.

A central PAM/PIM approach can therefore be applied across the organisation.

### How Must JIT and JEA Be Used?

#### Just-in-Time

For how long is the privilege open?

#### Just-Enough-Access

How much privilege is granted?

An administrator can be given, for instance;

a 30-minute privilege for a particular operation

instead of

permanent full admin.

That reduces standing privilege risk.

### Should MFA Be Used Everywhere?

Strong MFA must be assessed particularly on;

cloud admin,

Microsoft 365,

VPN,

PAM,

backup,

critical management

access.

But MFA alone is not enough.

Phishing-resistant authentication, conditional access and session security also matter.

### Why Is Machine Identity the New Major Risk Area?

In cloud and DevOps environments there can be more machine identities than people.

Service accounts.

Managed identities.

Kubernetes service accounts.

CI/CD identities.

API keys.

These identities can often be long-lived and overprivileged.

A machine identity inventory is therefore becoming mandatory.

### How Must Secret Management Be Carried Out Across the Organisation?

Secrets must not be kept inside;

source code,

config files,

Excel,

email,

scripts.

A central vault or secret manager must be used.

But the real goal of secret management is not merely storing them securely.

It must be **reducing static secret use**.

### Why Is Network Segmentation a Common Security Layer?

When the attacker compromises one system they must not be able to reach the other systems directly.

Therefore;

the user network,

the server network,

the database network,

the backup network,

the management network,

cloud VPC/VNet

can be separated.

But segmentation is not merely VLANs.

Access rules must be kept to a minimum.

### How Is Zero Trust Applied in System and Cloud Security?

Zero Trust rejects the assumption:

**inside the network = trusted**

as a starting point.

Every access is assessed through;

identity,

device,

risk,

resource,

context.

This model unites on-premise and cloud security under a common principle.

### How Is Security Monitoring Made Central?

Telemetry must be collected from different systems.

For example;

Windows Event Logs,

Linux logs,

Active Directory,

Entra ID,

AWS CloudTrail,

Azure Activity Logs,

GCP Audit Logs,

Kubernetes Audit,

Database Audit,

Backup Logs

can be sent to the SIEM.

That provides central visibility.

### Must Every Log Be Sent to the SIEM?

No.

Unlimited log shipping can create;

cost,

noise,

storage

problems.

The priority must be high-value telemetry.

For example;

privileged changes,

authentication,

security configuration,

critical data access

events carry high value.

### What Is Detection Engineering?

Sending logs to the SIEM is not security on its own.

Meaningful detection must be produced from those logs.

Detection engineering contains the design of;

use cases,

correlation,

thresholds,

behaviour analysis.

The aim must be not merely to collect logs but to see the attack.

### System & Cloud Security Use Case Examples

For example:

#### New Domain Admin Created

#### Cloud Owner Assigned

#### MFA Disabled

#### Public Storage Created

#### Privileged Kubernetes Pod Deployed

#### Database Audit Disabled

#### Backup Retention Changed

#### Large Data Export

#### New Access Key Created

These use cases show common risk behaviour across different platforms.

### How Must EDR and XDR Be Positioned?

EDR monitors endpoint and server behaviour.

XDR can combine different telemetry layers.

For example:

A phishing mail.

↓

Endpoint malware.

↓

Credential theft.

↓

Cloud login.

↓

Data access.

XDR can show the attack chain in a broader context.

### Is NDR Used in System and Cloud Security?

Yes.

Network detection and response can detect behaviour such as;

lateral movement,

unusual traffic,

C2,

data transfer.

On-premise and cloud network telemetry can be assessed together.

### How Must CSPM Be Connected to Corporate Security?

CSPM must not send the misconfigurations it finds only to the cloud team.

The risk must be related to;

asset criticality,

identity privilege,

data sensitivity,

internet exposure.

The real remediation priority is thereby determined.

### Where Does CNAPP Sit in the Corporate Model?

CNAPP can make cloud security risks central.

CSPM.

CWPP.

CIEM.

KSPM.

DSPM.

Attack path.

This telemetry must be integrated with the SOC and risk management.

CNAPP must not be a separate security island.

### Why Is Attack Path Analysis a Common Approach?

There are attack paths in Active Directory.

There are in cloud IAM.

There are in Kubernetes.

There can be privilege chains in database and backup environments too.

The security programme must therefore assess findings in relationship, not one by one.

### An Attack Path Example

For example:

Employee Laptop

↓

Local Admin

↓

Credential Dump

↓

Service Account

↓

Cloud SSO

↓

AWS Role

↓

Kubernetes Cluster

↓

Secret

↓

Database

Every step of this chain can belong to a different security team.

But the attack path is a single risk.

### What Is Blast Radius?

It expresses how broad an impact can form when an account or system is compromised.

For example;

a normal user account's blast radius can be low.

But a Domain Admin or Cloud Owner holds a very high blast radius.

The security architecture must reduce the blast radius as far as possible.

### Why Is Choke Point Analysis Valuable?

Many attack paths can pass through the same point.

If a single service account is used on dozens of attack routes, for instance, fixing that account provides very high risk reduction.

Remediation can therefore be carried out according to attack graph impact rather than severity alone.

### What Is Security Validation?

**Security validation** is the controlled verification of whether security controls genuinely work.

For example;

a hardening assessment,

a cloud security assessment,

a penetration test,

Red Team,

Purple Team,

a backup restore test

are different parts of security validation.

The basic principle:

**The existence of a control is not enough; its effect must be tested.**

### Are Security Validation and Compliance the Same Thing?

No.

Compliance:

Is the control there?

Security validation:

Does the control genuinely work?

The policy says, for instance:

“MFA is mandatory.”

Compliance passes.

But if MFA can be bypassed with old legacy authentication, the security is incomplete.

Validation therefore matters.

### Where Does the Penetration Test Sit in This Model?

A pentest actively tests particular attack surfaces.

For example;

web,

network,

cloud,

Active Directory,

Kubernetes

and similar.

But if the pentest is carried out once a year and then forgotten, security can age quickly.

A continuous validation approach is therefore stronger.

### Why Is Red Team Necessary?

A pentest generally verifies the vulnerabilities within a particular scope.

Red Team tests the attacker's capacity to reach the real target.

The target, for instance:

Domain Admin.

Production data.

Cloud admin.

Red Team can test the attack path end to end.

### Why Can Purple Team Be More Valuable?

Red Team attacks.

Blue Team detects.

Then the gaps are analysed together.

Detection is improved.

It is tested again.

This cycle raises the real quality of the defence.

### What Is BAS?

**Breach and attack simulation (BAS)** can be the approach providing continuous automatic and controlled testing of particular attack behaviour.

For example;

EDR detection,

SIEM rules,

network controls

can be verified periodically.

That contributes to continuous validation.

### What Is Continuous Security Validation?

It is security controls being verified continuously or periodically rather than through one large annual test.

For example;

monthly cloud misconfiguration tests,

quarterly AD attack path review,

regular restore tests,

periodic Purple Team

can be applied.

### How Is Backup Security Validation Carried Out?

The backup job can be “successful”.

But the real test:

Does the restore work?

Is the immutable backup genuinely undeletable?

Can the Domain Admin delete the backup?

Does the recovery time meet the RTO?

These must be tested in a controlled way.

### Disaster Recovery Security Validation

The DR plan can work on paper.

But in a real exercise;

DNS,

identity,

database,

network,

application dependency

problems can appear.

A DR drill must therefore be carried out.

### How Is Cloud Security Validation Carried Out?

For example;

Is the CSPM finding correct?

Is the public storage genuinely accessible?

Can the IAM attack path be used?

Does the JIT policy work?

Does the SIEM see cloud privilege escalation?

These questions can be tested in a controlled way.

### What Is Security Control Testing?

For every critical control this question is asked:

#### What happens if this control fails?

For example;

If EDR is disabled, does the SOC receive an alert?

If CloudTrail is switched off, is there an alert?

If backup retention is changed, is an event produced?

This approach is a resilience test.

### How Must Security Validation Results Be Managed?

For every finding;

an owner,

a priority,

a target date,

the business impact,

retest status

must be defined.

Otherwise assessment reports stay on the shelf.

Remediation tracking is a core part of the security programme.

### What Is a Security Finding SLA?

A fix period can be defined according to risk level.

For example:

Critical → 24/48 hours.

High → 7/15 days.

Medium → 30 days.

The periods must be determined according to the organisation's risk appetite.

### Why Does Mean Time to Remediate Matter?

It can be more valuable than a falling finding count.

An organisation produces 100 new findings a month, for instance.

But if it can close critical findings in 24 hours the process can be mature.

Remediation velocity must therefore be measured.

### How Must Risk Acceptance Be Managed?

Not every finding can be fixed.

An old protocol can be required because of a legacy application, for instance.

The risk can then be accepted consciously by;

the business owner,

security,

management.

But risk acceptance must not be open-ended.

There must be an expiration date.

### What Is a Compensating Control?

It is the alternative control reducing the risk when the main security control cannot be applied.

An old database does not support TLS, for instance.

The compensating control:

Private network + VPN + strict firewall.

That is not a complete solution but it can reduce the risk.

### Why Is Security Exception Management Necessary?

Hundreds of exceptions can form in an organisation.

For every exception there must be;

a reason,

an owner,

the risk,

a compensating control,

an expiry.

An exception whose period has ended must be reassessed.

### What Is System & Cloud Security Governance?

It is the management model answering the security programme's questions of;

who decides,

who implements,

who approves,

who monitors.

It matters as much as the technology.

### Can the RACI Model Be Used?

Yes.

For cloud security policy, for instance:

**Responsible** – Cloud Team.

**Accountable** – CTO/CISO.

**Consulted** – Security.

**Informed** – Application Owner.

A similar model can be applied for patch, backup and IAM.

### Who Should the Security Owner Be?

The security team does not own every system.

Security creates the risk framework.

The technical owner fixes the configuration.

The business owner owns the business impact of the risk.

This division of responsibility must be clear.

### What Does a Cloud Center of Excellence Do in Security?

A **Cloud Center of Excellence (CCoE)** can define cloud governance, architecture and security standards centrally.

The platform team.

Security.

DevOps.

FinOps.

Architecture.

They can work together.

This approach provides standardisation in large cloud structures.

### The Security Champion Model

There can be a person more competent in security within each development or cloud team.

That person becomes the bridge between the central security team and the team.

But leaving security entirely to that person is not correct.

This is a shared responsibility model.

### How Does DevSecOps Strengthen System and Cloud Security?

Security controls are moved before deployment.

For example;

IaC scanning,

secret scanning,

container scanning,

policy as code

run inside CI/CD.

That reduces errors before they reach production.

### Is Shift Left Enough on Its Own?

No.

A manual change can be made in production.

A runtime attack can happen.

Therefore;

**Shift Left + Runtime Security + Continuous Validation**

must be used together.

### Why Is Infrastructure as Code Strategic?

Through IaC, cloud configuration can be brought under code review and version control.

That provides;

standardisation,

security,

recovery

advantages.

But the IaC code itself must also be put through a security assessment.

### Why Is Policy as Code Necessary?

Security policy is not left dependent on people remembering.

For example:

Public databases forbidden.

Encryption mandatory.

Privileged containers forbidden.

These rules can be enforced automatically.

This is one of the most powerful tools of cloud governance.

### Preventive, Detective and Corrective Control

A strong security programme contains three kinds of control.

#### Preventive

Prevents the problem forming.

Policy as Code, for instance.

#### Detective

Detects the problem.

CSPM/SIEM, for instance.

#### Corrective

Fixes the problem.

Automated remediation, for instance.

A fourth layer must be added on top of these:

#### Validating

Verifies that the control genuinely works.

### What Is a Security Maturity Model?

It is the model helping measure the organisation's security level in stages.

An example maturity model can be created for system & cloud security.

### Level 1 – Reactive

At this level security is carried out after the incident.

The asset inventory can be incomplete.

There is no standard hardening.

Cloud resources are managed manually.

Logging is fragmented.

There is backup but the restore is not tested.

The basic approach:

**“We will look at it if there is a problem.”**

### Level 2 – Controlled

Basic security controls have been applied.

There is an asset inventory.

EDR is used.

There is MFA.

Firewall and backup are managed.

But the processes are largely manual.

Security review can be periodic.

### Level 3 – Standardized

A corporate baseline has been created.

CIS hardening is applied.

IAM is managed with minimum privilege.

There is a central SIEM.

CSPM is used.

Backup restore is tested.

Security processes have been standardised.

### Level 4 – Integrated

Security systems work together.

EDR + SIEM + IAM + CSPM + CNAPP are integrated.

Attack paths are analysed.

PAM/JIT is used.

The DevSecOps pipeline contains security.

Security telemetry flows centrally to the SOC.

At this level security holds an integrated structure.

### Level 5 – Continuously Validated

This is the most mature model.

Security controls are tested continuously.

Purple Team.

BAS.

Cloud attack path validation.

Automated compliance.

Continuous CSPM/CNAPP.

Restore testing.

Threat-informed validation.

At this level security becomes:

**measured, not assumed**

as its defining quality.

### How Is System & Cloud Security Maturity Measured?

Different areas can be scored.

For example:

#### Asset Visibility

#### Hardening

#### Vulnerability Management

#### Identity Security

#### Cloud Security

#### Workload Protection

#### Monitoring

#### Backup & Recovery

#### Security Validation

Each area can be assessed at level 1-5.

### What Should the Management Dashboard Be?

Showing 50,000 technical findings to management is meaningless.

More valuable metrics:

#### Critical Attack Path Count

#### Critical Public Asset Count

#### Privileged Account Count

#### MFA Coverage

#### Critical Vulnerability MTTR

#### Immutable Backup Coverage

#### Restore Test Success

#### Logging Coverage

#### Security Validation Coverage

metrics of this kind can be used.

### How Are Technical KPIs Connected to Business KPIs?

The technical metric, for instance:

10 critical vulnerabilities.

The business equivalent:

3 of them are on the payment system.

1 of them is internet-facing.

That information is far more valuable.

In the same way:

Backup restore success 95%.

But 0% on the finance system.

That creates a critical business risk.

### Can a System Security Posture Score Be Used?

Yes.

But a single number must be used carefully.

For example:

System Security Score: 84/100.

But underneath it:

A critical Domain Admin attack path.

If that exists it matters more.

The score and the critical findings must therefore be presented together.

### Can a Cloud Security Posture Score Be Used?

It can be used in the same way.

IAM.

Network.

Data.

Workload.

Logging.

Backup.

These areas can be scored.

But the average score must not hide the critical attack paths.

### How Is a Risk Heatmap Used?

For example:

| Area | Risk |
| --- | --- |
| Active Directory | High |
| Cloud IAM | High |
| Server Hardening | Medium |
| Backup | Low |
| Kubernetes | High |

That can provide fast visibility for management.

But the reason behind the risk must be explained.

### What Is the RAG Model?

#### Red

Critical improvement required.

#### Amber

Risk exists, planned remediation required.

#### Green

Controls are sufficient.

It can be used on management dashboards.

But “Green” does not mean permanently secure.

Validation must continue.

### How Is a System & Cloud Security Roadmap Created?

It is not possible to fix all the gaps at once.

A staged roadmap can therefore be created.

#### The First 30 Days

Critical exposure.

Privileged accounts.

MFA.

Backup risks.

#### 30–90 Days

Hardening.

CSPM.

Logging.

PAM.

#### 3–6 Months

CNAPP.

DevSecOps.

Attack path analysis.

#### 6–12 Months

Continuous validation.

Purple Team.

Maturity improvement.

This example must be tailored to the organisation's risk.

### What Can the Quick Wins Be?

For example;

closing public RDP,

removing an unused admin account,

switching root MFA on,

making public storage private,

creating a backup deletion alert,

enabling CloudTrail/audit

can provide high benefit.

Quick wins are valuable for the first risk reduction.

### What Are the Strategic Security Investments?

Longer-term work:

A PAM transformation.

Zero Trust architecture.

CNAPP.

SIEM modernisation.

A multi-account landing zone.

Immutable backup.

A cloud-native SOC.

These can require broader investment.

### When Must a Security Architecture Review Be Carried Out?

It must be carried out before a new;

cloud migration,

ERP,

Kubernetes,

identity platform,

data centre,

backup architecture.

Security must not be a layer added afterwards.

It must be assessed at the design stage.

### What Is Security by Design?

It is security controls being included in the architecture while the system is designed.

Rather than making a database private after it reaches production, for instance, it is designed private from the start.

That is both more secure and cheaper.

### What Is Secure by Default?

It is the default settings being secure when a new system is created.

For example;

public storage disabled,

MFA mandatory,

logging enabled,

private network by default.

The user does not have to switch security on manually.

### Why Is Default Deny a Basic Principle?

At the start no access is allowed.

The necessary access is opened one by one according to business need.

This principle can be applied for;

firewall,

IAM,

RBAC,

Network Policy.

### What Is Assume Breach?

It is one of the important principles of Zero Trust.

The architecture is designed assuming an attacker can compromise a system.

The question:

**“If they get inside, how far can they advance?”**

must be asked.

Lateral movement, segmentation and blast radius therefore become critical.

### What Is Defence in Depth?

It is the layered defence approach assuming a single control will fail.

For example:

Firewall.

WAF.

EDR.

PAM.

SIEM.

Backup.

Even if one control is passed, the next layer can stop or detect the attack.

### The Relationship Between Cyber Resilience and System & Cloud Security

The aim of security is not merely preventing the attack.

The organisation must;

prevent the attack,

detect it,

limit it,

respond,

recover.

This is the **cyber resilience** approach.

System and cloud security forms its technical foundation.

### Why Must Recoverability Be a Security KPI?

It is not possible to block the attacker 100%.

This question is therefore also within security scope:

#### In how many hours does a critical system come back?

Backup restore.

DR.

Identity recovery.

Clean room.

All of these are part of the security programme.

### How Often Must the Security Programme Be Reviewed?

A fixed annual review can be insufficient.

Reassessment is required particularly after;

a cloud migration,

M&A,

a new application,

a major identity change,

a ransomware incident.

A regular maturity review can also be carried out.

### How Must Threat Intelligence Be Connected to the System?

Current threat information can change vulnerability and detection priorities.

If there is a new actively exploited CVE, for instance;

which systems hold it?

which of them is public?

which is a crown jewel?

can be determined quickly.

This is the **threat-informed defence** approach.

### What Is Threat-Informed Security Validation?

Exercise scenarios are designed according to real attacker behaviour.

If in the sector;

cloud credential theft,

MFA bypass,

backup deletion

are rising, these can be added to the validation scenarios.

The tests thereby become better aligned with the real threats.

### Can MITRE ATT&CK Be Used?

Yes.

Detection and Red/Purple Team scenarios can be mapped to ATT&CK techniques.

For example;

Valid Accounts,

Remote Services,

Account Manipulation,

Cloud Service Discovery

and similar behaviour can be used.

But the framework is a tool, not a goal.

### How Are Security Controls Mapped to ATT&CK?

For every critical attack technique:

A preventive control.

A detective control.

A response action.

can be determined.

For example:

Credential Theft.

Prevent → hardening/PAM.

Detect → EDR/ITDR.

Respond → credential revoke.

That provides **control mapping**.

### How Is Detection Coverage Measured?

The organisation's 50 most critical attack techniques are determined, for instance.

In how many of them is there active detection?

How many have been tested?

These two values differ.

#### Configured Detection Coverage

and

#### Validated Detection Coverage

must be measured separately.

### Why Is Validated Security Coverage More Valuable?

There can be 300 correlation rules in the SIEM.

But if they have never been tested, how many of them work is unknown.

Therefore:

#### Rule Count

rather than which,

#### Validated Detection Coverage

can be a more meaningful KPI.

### What Should a Security Validation Report Be Like?

A professional report can include these areas:

#### Executive Summary

General risk and maturity.

#### Asset Visibility

Inventory coverage.

#### Hardening

Baseline compliance.

#### Identity Security

AD, Entra and cloud IAM.

#### Cloud Security

CSPM/CNAPP posture.

#### Workload Security

Server, container, Kubernetes.

#### Data & Database Security

Access and monitoring.

#### Backup & Recovery

Ransomware resilience.

#### Detection

SIEM, EDR/XDR and SOC.

#### Attack Path Analysis

Critical attack chains.

#### Security Validation

Tested controls.

#### Remediation Roadmap

The action plan.

### How Must the Executive Summary Be Written?

For example:

**“In the assessment carried out, 92% of critical systems are within central security monitoring. But two critical privileged attack paths reaching from Active Directory to the cloud production environment were detected. On the cloud side, 11 permanent administrator accounts and 4 internet-facing management services were found. Immutable backup coverage is 74% and the last restore test success rate is 96%. In the first 90-day roadmap, privileged access reduction, closing management exposure and backup isolation have been prioritised.”**

That is meaningful for management.

### What Is the Biggest Mistake in Corporate System and Cloud Security?

The biggest mistake is seeing security as a product list.

“We have EDR.”

“We have a SIEM.”

“We have CSPM.”

“We have PAM.”

These matter.

But the real questions are these:

#### Is EDR active on all the critical systems?

#### Does the SIEM see the correct use cases?

#### How long does CSPM take to close a critical misconfiguration?

#### Is privileged access possible outside PAM?

#### Can the backup be deleted by an attacker?

#### Have we genuinely tested these?

The security level is determined not by the existence of the product but by the **effectiveness of the control**.

### System & Cloud Security Operating Model

A mature structure can use this cycle:

#### Discover

Asset and attack surface.

↓

#### Classify

Criticality and data.

↓

#### Harden

CIS and the security baseline.

↓

#### Protect

EDR, PAM, segmentation, CSPM.

↓

#### Monitor

SIEM, XDR, CNAPP.

↓

#### Detect

Use cases and behaviour analytics.

↓

#### Respond

Incident response.

↓

#### Recover

Backup and DR.

↓

#### Validate

Pentest, Purple Team, restore test.

↓

#### Improve

Remediation and maturity.

This model must run again and again.

### Core Control Areas for Corporate System and Cloud Security

A mature security programme must manage at least these areas together:

#### Asset Management

Know what you are protecting.

#### Secure Configuration

Hardening and the CIS baseline.

#### Vulnerability Management

A risk-based patch process.

#### Identity Security

AD, Entra, IAM and machine identity.

#### Privileged Access

PAM, PIM, JIT and JEA.

#### Network Security

Segmentation and Zero Trust.

#### Cloud Security

CSPM and CNAPP.

#### Workload Security

EDR, CWPP and Kubernetes.

#### Data Security

Database, encryption and DAM.

#### Monitoring

SIEM, XDR and SOC.

#### Backup & Recovery

Immutable backup and DR.

#### Security Validation

Pentest, Red/Purple Team and continuous validation.

### Conclusion: System and Cloud Security Is a Continuously Measured Resilience Programme

A modern organisation's security architecture no longer consists only of a firewall and antivirus.

Windows.

Linux.

Active Directory.

Microsoft 365.

AWS.

Azure.

Google Cloud.

Kubernetes.

Database.

Backup.

All are parts of the same digital ecosystem.

And the attacker can move between these structures easily.

Security must therefore be managed with the same wholeness.

A genuine **system & cloud security** programme must be able to answer these questions:

#### Which assets do we own?

#### Which of them are critical?

#### Which of them are open to the internet?

#### Who is privileged?

#### Which systems have drifted from the baseline?

#### Which attack paths reach crown jewel systems?

#### Which security controls can see the attack?

#### How fast does the SOC respond?

#### Can the backup genuinely come back?

#### When was the last security validation carried out?

If the answers to these questions can be kept continuously current, the organisation stops being one that merely uses security products.

**It begins managing a measurable cyber resilience programme.**

The most correct security approach therefore:

**Begins with hardening.**

**Strengthens with identity.**

**Becomes visible with monitoring.**

**Is verified with security validation.**

**Becomes resilient with backup and disaster recovery.**

And the most important conclusion of the **system and cloud security** series is this:

**Security is not assuming a system is secure; it is measuring and verifying continuously that it is.**