Cloud Security Fundamentals bibliography

Standards-body + government · 2

1. MITRE Corporation (2024). MITRE ATT&CK Cloud Matrix. MITRE Corporation. https://attack.mitre.org/matrices/enterprise/cloud/
2. MITRE Corporation (2024). T1098.001 Account Manipulation: Additional Cloud Credentials. MITRE ATT&CK. https://attack.mitre.org/techniques/T1098/001/

Other primary sources · 22

1. Cloud Security Alliance (2021). Cloud Controls Matrix v4 (CCM v4.0.12, current as of 2024). Cloud Security Alliance. https://cloudsecurityalliance.org/research/cloud-controls-matrix
2. Cloud Security Alliance (2024). Top Threats to Cloud Computing 2024. Cloud Security Alliance. https://cloudsecurityalliance.org/research/top-threats
3. Cloud Security Alliance (2024). Top Threats to Cloud Computing 2024: Pandemic Eleven (T2 Insecure Interfaces and APIs, T7 Misconfiguration and Inadequate Change Control). Cloud Security Alliance. https://cloudsecurityalliance.org/research/top-threats
4. Chandramouli, R., & Iorga, M. (2020). General Access Control Guidance for Cloud Systems (NIST SP 800-210). National Institute of Standards and Technology. doi:10.6028/NIST.SP.800-210
5. Microsoft Corporation (2024). Shared Responsibility in the Cloud. Microsoft Learn Documentation. https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
6. Microsoft Corporation (2024). Azure Activity Log and Microsoft Entra Audit Logs. Microsoft Learn Documentation. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
7. Cloud Native Computing Foundation (2024). Pod Security Standards (Restricted, Baseline, Privileged). Kubernetes Documentation. https://kubernetes.io/docs/concepts/security/pod-security-standards/
8. ISC2 (2024). Cybersecurity Workforce Study 2024: Cloud Security Roles. International Information System Security Certification Consortium. https://www.isc2.org/research
9. ISC2 (2024). Cybersecurity Workforce Study 2024. International Information System Security Certification Consortium. https://www.isc2.org/research
10. Liu, F., Tong, J., Mao, J., Bohn, R., Messina, J., Badger, L., & Leaf, D. (2011). NIST Cloud Computing Reference Architecture (NIST Special Publication 500-292). National Institute of Standards and Technology. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-292.pdf
11. Google LLC (2024). Google Cloud Shared Responsibility and Shared Fate Models. Google Cloud Documentation. https://cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate
12. Google LLC (2024). Cloud Audit Logs Overview (Admin Activity, System Event, Data Access, Policy Denied). Google Cloud Documentation. https://cloud.google.com/logging/docs/audit
13. Mell, P., & Grance, T. (2011). The NIST Definition of Cloud Computing (NIST Special Publication 800-145). National Institute of Standards and Technology. doi:10.6028/NIST.SP.800-145
14. Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture (NIST SP 800-207). National Institute of Standards and Technology. doi:10.6028/NIST.SP.800-207
15. Center for Internet Security (2024). CIS Amazon Web Services Foundations Benchmark v3.0. Center for Internet Security. https://www.cisecurity.org/benchmark/amazon_web_services
16. Center for Internet Security (2024). CIS Kubernetes Benchmark v1.9. Center for Internet Security. https://www.cisecurity.org/benchmark/kubernetes
17. Center for Internet Security (2024). CIS Amazon Web Services Foundations Benchmark v3.0, §3 Logging. Center for Internet Security. https://www.cisecurity.org/benchmark/amazon_web_services
18. Amazon Web Services (2024). AWS Shared Responsibility Model. AWS Documentation. https://aws.amazon.com/compliance/shared-responsibility-model/
19. Amazon Web Services (2024). IAM JSON Policy Reference (Action, NotAction, Resource, Condition). AWS Documentation. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
20. Amazon Web Services (2024). Logging IAM and AWS STS API Calls with CloudTrail. AWS Documentation. https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html
21. Souppaya, M., Morello, J., & Scarfone, K. (2017). Application Container Security Guide (NIST SP 800-190). National Institute of Standards and Technology. doi:10.6028/NIST.SP.800-190
22. U.S. Bureau of Labor Statistics (2024). Occupational Employment and Wage Statistics, May 2024: 15-1212 Information Security Analysts. U.S. Department of Labor. https://www.bls.gov/oes/current/oes151212.htm