The Single-Layer Defense

Edition #22: The Single-Layer Defense

Your IaC scanning caught 127 violations in pull requests this quarter. Zero violations reached production through the pipeline. You're confident every infrastructure change gets validated before deployment.

Then a public S3 bucket appears. Nobody changed Terraform. The deployment pipeline never touched it. An ops engineer created it manually in the console to test something quickly.

This is The Single-Layer Defense - when teams rely on one control point while changes flow from multiple angles.

Teams invest in build-time scanning because that's where governance feels most effective. Every PR gets reviewed, every Terraform change validated, every violation caught before merge. It creates confidence - comprehensive pipeline scanning means comprehensive protection.

But infrastructure changes don't only flow through pipelines. Console access, CLI tools, emergency fixes, sandbox accounts - changes come from everywhere. Build-time scanning creates false confidence while leaving massive blind spots.

Violations appear despite clean pipeline scans. Your team can't explain how they happened. Security questions you can't answer: "How did this public bucket get created?" Governance loses credibility when obvious bypasses exist.

Build defense in depth across four control layers using the Controls Practice from the 5 Practices of Cloud Governance:

→ Build layer - IaC scanning catches violations during PR review before merge when rework is cheap.
→ Access layer - Organization policies (AWS SCPs, Azure Policy, GCP Organization Policies) block risky API calls regardless of access method - console, CLI, or pipeline.
→ Config layer - Secure defaults (S3 Block Public Access, EBS encryption by default) enforce standards invisibly at account level.
→ Runtime layer - Detective controls with auto-remediation catch drift that bypassed other layers.

Multiple preventive layers before falling back to runtime detection. No single bypass defeats all layers. Console change gets caught by access layer. Pipeline change gets caught by build layer. Comprehensive coverage across the entire deployment lifecycle.

- Keep on Herding, Bob

What's Happening in Cloud Governance 📡

Google Cloud Security Podcast: Google Cloud Security Podcast features conversations with security practitioners about cloud governance challenges and solutions. The podcast covers topics from zero trust architecture to compliance automation and incident response in cloud environments.

OWASP LLM Top 10: The OWASP LLM Top 10 identifies critical security risks in large language model applications including prompt injection, data leakage, and model poisoning. Organizations deploying LLMs need governance controls that address these AI-specific vulnerabilities.

The Cost of Compute 2026: What 100 CFOs Reveal About Cloud Infrastructure's Impact on the P&L: CFO survey reveals that cloud infrastructure costs are increasingly impacting P&L statements, driving demand for better financial governance. Organizations are seeking FinOps practices and tools to optimize spending while maintaining business agility.

AWS Strategy and Organizational Change Management: AWS prescriptive guidance on strategy and organizational change management provides frameworks for cloud transformation initiatives. Successful programs address people, process, and technology dimensions while establishing governance that scales with adoption.

Get Involved 👋

Join the conversation on LinkedIn about this newsletter edition.