Cloud Security Orienteering: Navigating Legacy & Multi-Cloud Chaos
Rami McCarthy shares a pragmatic guide for newly hired security engineers to rapidly orient, map, and prioritize risk in sprawling, messy multi-cloud estates.
Summary
The Reality of Messy Enterprise Cloud Environments
Few security professionals inherit pristine, greenfield cloud architectures; most must secure sprawling multi-account environments filled with technical debt and orphaned assets.
Rapid Reconnaissance and Asset Mapping
Rami McCarthy introduces 'Cloud Security Orienteering', a structured methodology to quickly discover account hierarchies, IAM boundaries, and internet-facing egress points.
Prioritizing High-Impact Vulnerabilities Over Alert Noise
McCarthy explains how to cut through thousands of CSPM alerts to focus on toxic risk combinations—such as public buckets linked to overprivileged service accounts.
A 30-60-90 Day Roadmap for Cloud Security Leads
The presentation provides actionable guidance for building relationships with DevOps teams, establishing automated baseline guardrails, and driving remediation.
Related talks
Cloud Village·23 min
Muhammad Yuga Nugraha
TencentGoat: an intentionally vulnerable Tencent Cloud environment for hands-on cloud security training.
Cloud Village·16 min
Yuval Avrahami
Palo Alto Networks researcher Yuval Avrahami presents WhoC, a container image tool that extracts the underlying container runtime in public CaaS clouds.
Cloud Village·34 min
Tanya Janca
DIY methodology for assessing and auditing Azure cloud security posture.