Cloud Security
The security overlay that every infrastructure diagram gets: public exposure with context rather than reflex, trust boundaries, encrypted links, privileged resources, and the supply chain from source through build identity to the image production actually pulls.
Every infrastructure diagram in this domain gets a second reading. The overlay highlights seven things — public exposure, private networks, identities, secrets, encrypted links, privileged resources and trust boundaries — and turns "here is our architecture" into "here is what an attacker can reach and what they get".
Q · What does this infrastructure diagram look like when you read it the way an attacker would?
A scanner that flags every public endpoint is useless. The skill is judging which exposure is the design and which is the finding: a load balancer on 443 is the front door, a database on 5432 is an incident waiting, and a public bucket is either a website or a data breach depending entirely on what is in it.
Q · This resource has a public address — is that the design working, or is it the finding?
Five places where trust changes hands — internet to edge, edge to application, application to data, CI to production, provider to you — and the specific control that has to enforce each one. Most incidents are a boundary that was assumed rather than enforced.
Q · Where in this system does trust change hands, and what actually enforces it there?
Source → build identity → artifact → registry → what production actually pulls. Every hop is a place to substitute something. The two questions that matter: can you prove the running image came from your source, and who else could have put something there?
Q · What exactly is running in production right now, and can you prove it came from your source?