Why security work gets postponed
Product deadlines always outrank hardening, so security drifts. Nobody decides to leave an admin key from 2022 active, an S3 bucket public, or a node image six months old. It happens because the work has no owner and no schedule. Then a customer questionnaire or a SOC 2 audit arrives and the team spends weeks reconstructing evidence.
Making compliance routine fixes that. It is a standing part of our Managed DevOps service, alongside Kubernetes operations and Terraform maintenance, because most fixes are infrastructure changes.
What good looks like
- A measured baseline, not a feeling, for each account and cluster.
- Least-privilege access control with MFA everywhere humans log in.
- No long-lived credentials where short-lived ones are possible.
- Encryption at rest and in transit, with logging enabled for audit trails.
- Vulnerabilities found by scanning, ranked by risk, and patched within a known cycle.
- Exceptions recorded with an owner and an expiry date.
How it works in practice
CIS benchmark scanning
CIS benchmarks translate “be secure” into checks such as “ensure CloudTrail is enabled in all regions” or “ensure the kubelet does not allow anonymous authentication”. We run open source scanners against each layer: Prowler or Security Hub standards for AWS, Defender for Cloud on Azure, kube-bench for Kubernetes nodes and the control plane settings you can influence, and Linux checks for any self-managed hosts. On managed Kubernetes services, some control plane recommendations belong to the provider, so we report only what you can actually change.
prowler aws --compliance cis_2.0_aws --severity critical high \
--output-formats html json
Check the benchmark version your auditor or customer expects; versions differ.
Scan output is a starting list, not a verdict. Some findings are false positives for your architecture and some are accepted risks. We document each decision.
IAM reviews
Access problems are the most common root cause of serious cloud breaches, and they accumulate silently. Our review covers:
- Human users: MFA, last login, departed staff, and direct user permissions that should be group or role based.
- Access keys: age, last use, and whether they can be replaced by roles or federation.
- Roles and policies: wildcards on actions or resources, privilege escalation paths, and cross-account trust relationships.
- Service accounts: Kubernetes service accounts bound to cloud roles, with scope limited to what the workload needs.
- Break-glass access: exists, is sealed, and alerts when used.
AWS IAM Access Analyzer helps find unused access and external sharing. Fixes are made as code, so tightened policies persist.
Cluster hardening
In Kubernetes we look at RBAC, pod security settings, network policies to limit lateral movement, and how secrets are stored. Native Kubernetes secrets are only base64 encoded, so we use external secret stores or sealed secrets for GitOps flows. Admission controllers such as Kyverno or OPA Gatekeeper can enforce rules, for example denying privileged containers, and are introduced in audit mode first.
CVE patching
A vulnerability scanner will always find more issues than anyone can fix. Patching is a triage problem:
| Factor | Question |
|---|---|
| Exposure | Is the component reachable from the internet? |
| Exploitability | Is it known to be exploited, and is a fix available? |
| Impact | What data or privilege does the system hold? |
| Effort | Is it a base image bump or a major rewrite? |
Container images are scanned in the pipeline with a tool such as Trivy and rebuilt regularly so patched layers flow through normal deploys. Node patching follows the Kubernetes maintenance calendar. Critical, actively exploited vulnerabilities follow an emergency path with immediate communication.
Logging, encryption and the audit trail
Auditors and incident responders ask the same question: can you show who did what, and when? That depends on logging being enabled before something goes wrong. Our baseline turns on cloud audit logs in every region and account, ships them to a separate, write-restricted location so an attacker with workload access cannot erase them, and sets retention to match your obligations. Kubernetes audit logging is configured where the managed service allows it.
Encryption follows the same logic. Storage, databases and backups should be encrypted at rest with keys you control where it matters, and traffic between services should use TLS. These are typically one-line Terraform settings, but they are easy to miss on resources created by hand, which is why our infrastructure as code work and security scans reinforce each other.
Decisions and trade-offs
Audit mode versus enforcement. Enforcing early breaks deployments and builds resentment. Auditing forever changes nothing. We set a date to switch.
Compliance is not security. Passing a benchmark does not mean you are safe, and a failed check is not always dangerous. We aim for risk reduction first and a clean report second.
Tooling cost. Commercial posture management platforms are polished but add cost. Open source scanners cover most startup needs; we recommend paid tools when scale or audit requirements justify them.
What we do not do. We are not an auditor, penetration testing firm or legal adviser. For SOC 2, ISO 27001 or HIPAA programmes you need an accredited auditor and policy work. We handle the technical controls and evidence behind them.
Common failure modes
- Scan once, forget. Posture decays without recurring scans.
- Exception sprawl. Waivers with no expiry become the new normal.
- Secrets in repositories. We add secret scanning to the pipeline and rotate anything exposed.
- Over-privileged CI. A pipeline role that is effectively admin. We narrow it, as covered under credentials without long-lived keys.
Delivery and handover
We deliver a baseline report, a prioritised remediation backlog, and then a monthly cycle: scan, fix, review access, patch, report. Evidence is collected from tools and Git history, not screenshots. Every control has a runbook, and everything stays in your accounts.
How to tell it is working
Track critical and high findings open over time, mean age of open vulnerabilities, percentage of identities with MFA, count of long-lived keys, and exceptions past expiry. Falling numbers on all five mean security is a habit, not a project. To scope a baseline review, contact us.