CLOUD SECURITY ARCHITECTURE
Map the boundaries
before the build.
Start an AWS and hybrid cloud review by documenting accounts, identities, network paths, data flows, and connections to private infrastructure or OpenShift.
- 01
Separate responsibilities and trust
Define account boundaries, privileged access, workload identities, and who owns each control.
- 02
Review network and data paths
Document ingress, egress, private connectivity, segmentation, encryption, and secrets handling.
- 03
Design for operations
Specify logging, detection, incident access, recovery, and the evidence needed to validate the design.
- 04
Verify across the boundary
Test expected access and denied paths between AWS, private cloud, and OpenShift workloads within the agreed scope.
01 / PLATFORM SECURITY
Prepare an OpenShift
security review.
Begin with an agreed cluster and workload boundary. Record platform versions, environment purpose, owners, and which changes require operational approval.
Compliance scanning helps identify configuration gaps, but scan output still needs context, evidence review, and a remediation decision.
Explore OpenShift security services ↗
Official reference: Red Hat Compliance Operator ↗
Upstream reference: OpenShift Compliance Operator project ↗
If Red Hat documentation is temporarily unavailable, use the upstream project overview as a starting point. The reference above opens the 4.21 guide. Select the documentation for your installed platform and Operator versions.
- 01
Map access boundaries
List administrators, service accounts, roles, and namespace access. Identify privileged identities and the business need behind them.
- 02
Review workload controls
Check network isolation, security context constraints, secret handling, and image provenance within the agreed scope.
- 03
Separate evidence from conclusions
Record scan date, profile, version, affected resources, and manual checks. Investigate failures before selecting remediation.
- 04
Plan a controlled retest
Agree changes, rollback steps, and verification criteria. Retest the configuration and confirm the workload still functions.
02 / ASSESSMENT & EVIDENCE
Make a STIG assessment
traceable.
A useful assessment connects each applicable requirement to an observed state, a reasoned result, and supporting evidence.
Document applicability and exceptions explicitly. Approval of exceptions and authorization decisions belongs to the responsible authority.
Explore STIG assessment services ↗
- 01
Establish the baseline
Identify the system boundary and applicable benchmark version and release. Keep that baseline with the assessment record.
- 02
Assess each requirement
Use automated checks where appropriate and complete the manual review. Record the actual state and rationale for each result.
- 03
Organize the evidence
Reference the rule identifier, affected asset, collection date, reviewer, and evidence location. Use an approved repository for sensitive evidence.
- 04
Close the loop
Assign corrective actions and due dates. Record retest results, unresolved gaps, and approved exceptions rather than treating a planned fix as complete.
03 / APPLICATION SECURITY
Turn findings into
verified fixes.
Use an agreed set of security requirements to connect assessment, engineering work, and release review.
OWASP ASVS provides verification requirements; the Cheat Sheet Series offers implementation guidance. Choose requirements relevant to the application and its risk.
Explore application security services ↗
- 01
Define the test boundary
Identify authorized targets, roles, data flows, dependencies, and permitted testing methods before assessment begins.
- 02
Triage with context
Confirm affected versions, exposure, exploit conditions, and existing controls. Prioritize actionable findings and document false-positive rationale.
- 03
Connect fixes to delivery
Track the owner, code or configuration change, pipeline checks, and target release. Keep credentials out of source and routine logs.
- 04
Verify the outcome
Retest the original issue, check for regressions, and record the deployed version and remaining risks before closure.
AI SECURITY / WATCH & APPLY
New capabilities.
Familiar trust boundaries.
Bring application-security discipline to AI features. Explore prompt injection, retrieval data protection, and agent permissions through an OWASP AI Exchange video and interactive review scenarios.
Explore AI security learning ↗- 01
Watch with a purpose
An attributed overview paired with questions for your architecture review.
- 02
Test your judgment
Work through practical AWS, OpenShift, and application security scenarios.
- 03
Apply the controls
Connect access boundaries, secure delivery, and verification evidence.