Cloud Security Guides

AWS IAM best practices: a practitioner’s guide for 2026 Identity is the perimeter. If you are still treating network controls as your primary security boundary in AWS, you are designing for the wrong threat model. IAM best practices have never been more consequential than they are right now, in August 2026, when AWS is shipping significant identity changes at pace, agentic AI workloads are being handed cloud credentials at scale, and regulators from the FCA to the ICO are scrutinising access governance with renewed seriousness. This guide covers the controls, the tooling, and the trade-offs you actually need in production. ...

AWS Landing Zone and Control Tower: A Practitioner’s Security Guide If you are building a cloud programme for a UK financial services firm, a public sector department, or any enterprise with serious compliance obligations, getting the foundation right is non-negotiable. AWS landing zone and Control Tower are the two most important architectural decisions you will make before a single workload ever runs in production. Get them wrong and you will spend years paying down governance debt: unpicking ad-hoc account structures, hunting for who deleted that SCP, and failing FCA or NCSC assurance reviews. Get them right and every team that follows you inherits a secure, auditable baseline on day one. ...

AWS Shield DDoS protection: a practitioner’s guide for 2025 and beyond The threat environment for UK organisations running workloads on AWS is genuinely active right now. In December 2025, the NCSC co-sealed an advisory calling out pro-Russian hacktivist groups targeting government and private sector entities in NATO member states, with the NCSC’s Director of National Resilience noting that “denial-of-service attacks may be technically simple, their impact can be significant.” Whether you are protecting a retail payment platform, a government-facing portal, or a regulated financial service, AWS Shield DDoS protection is the foundational layer you need to get right. It is also going through its most significant architectural change in years. This guide covers tier selection, the new Anti-DDoS managed rule group, SRT engagement, multi-account deployment, and the mistakes I see organisations make repeatedly. ...

PCI DSS 4.0 on AWS: a practitioner’s guide to cloud compliance If your organisation stores, processes, or transmits payment card data on AWS, PCI compliance is no longer something you can treat as a periodic audit exercise. As of 31 March 2025, all requirements of PCI DSS 4.0 are mandatory. This isn’t just another version increment — it represents a genuine change in how payment security is assessed, particularly in cloud environments. ...

Cloud Security Vulnerability Management: a practitioner’s guide for AWS environments Cloud security vulnerability management is a continuous operational discipline, not a periodic hygiene exercise. Cloud infrastructure changes constantly as teams deploy new workloads, APIs, and services across multi-account and hybrid environments, and each change can introduce vulnerabilities, misconfigurations, or exposed attack paths that attackers can reach within minutes. For UK financial services firms under FCA oversight, or any organisation handling personal data under UK GDPR, the stakes are higher still: a single unmitigated CVE in a production workload is not just a technical failing, it is a potential regulatory event. ...

Post-Quantum Cryptography and AWS migration: a practitioner’s guide Post-quantum cryptography migration is no longer a theoretical exercise reserved for government cryptographers and academic papers. It is an active engineering programme with real deadlines, live AWS service releases, and regulatory consequences for UK financial services and critical national infrastructure. If you run workloads on AWS that involve long-lived sensitive data, digital signatures, or PKI, this guide is for you. I will walk through the standards landscape, what AWS has already shipped, where your responsibilities lie under the shared responsibility model, and the practical steps needed to avoid being caught flat-footed when the 2028 NCSC checkpoint arrives. ...

HIPAA compliance on AWS: what every cloud security architect actually needs to know If you are building or auditing healthcare workloads on AWS in 2026, HIPAA compliance is a live architectural constraint with real enforcement teeth. The Office for Civil Rights (OCR) at HHS continues to pursue breach investigations, hacking and IT incidents are now the dominant cause of breached health records on the OCR portal, and a major proposed overhaul of the HIPAA Security Rule is working its way through the federal rulemaking process. Sorting out your HIPAA posture on AWS is urgent regardless of where that rulemaking lands. This guide covers the foundation: what the Business Associate Addendum (BAA) actually gives you, how to structure HIPAA-eligible service usage, the technical controls you must configure yourself, and the common mistakes that turn a compliant architecture on paper into a reportable breach in practice. ...

Recent cloud security CVEs: July 2026 threat briefing for cloud architects If you manage cloud workloads and your vulnerability management process still runs on a monthly review cycle, this month is a fairly blunt argument for changing that. The CVEs disclosed across June and July 2026 cover container breakout in Azure Kubernetes Service, a 29-year-old memory leak in Squid Proxy, a pre-authentication remote code execution in WordPress core, and a record-breaking Microsoft Patch Tuesday that touched cloud services directly. Every one of these has implications for how you architect, detect, and respond, not just how quickly you click “update.” ...

Privileged Access Management in AWS: a practitioner’s guide Privileged access management in AWS is not an optional bolt-on. It is the difference between a controlled, auditable estate and one that is a single leaked credential away from serious trouble. Attackers target high-level access first because it is the most direct path to everything that matters. For UK financial services organisations under FCA oversight, or public sector bodies procuring via G-Cloud, this is not academic. It is a regulatory obligation. The NCSC’s cloud security principles explicitly address secure service administration, and your PAM posture will be scrutinised in any serious assurance engagement. ...

AWS Inspector vulnerability management: the definitive practitioner’s guide If your organisation is running workloads on AWS in 2025 and not actively managing vulnerabilities through Inspector, you are almost certainly carrying unquantified risk into production. The NCSC has warned organisations to prepare for a “patch wave” as exploitation timelines compress and AI tooling lowers the barrier for attackers. Against that backdrop, continuous automated vulnerability scanning is not optional for any organisation subject to FCA operational resilience requirements or NCSC CAF obligations. ...