Security Blog

Hands-on cloud security & career insight.

Practical tutorials, career roadmaps, and AWS / SOC security writing from the team.

Reading time

Sort

36 articles

DPDP Rules Are Final: A CISO's Playbook for One Breach and Four Reporting Clocks

The DPDP Rules were gazetted on 13 November 2025 with a phased runway to May 2027 — and for anyone RBI- or SEBI-regulated, DPDP is your fourth breach regime, not your first. Here is the CISO view: the exact obligations, the four reporting clocks, where DPDP collides with RBI's data rules, and a 90-day plan.

Jul 8, 2026

Career20 min

AWS Security Interview Questions: 40 Scenarios with Model Answers

Forty real AWS security interview questions across IAM, encryption, detection, IR, and architecture — each with a model answer and the follow-up the interviewer often asks.

Jun 30, 2026

Cloud Security13 min

SCS-C03 vs CCSP vs CISSP: Which Cloud Security Certification Should You Take?

A working engineer's side-by-side of the three certifications hiring managers actually recognise for cloud security roles — with a decision framework, India-market context, and stacking strategy.

Jun 30, 2026

Career18 min

Cloud Security Engineer Roadmap 2026: Skills, Certs, and Portfolio

A practitioner's cloud security engineer roadmap for 2026 — a 12-month plan with monthly milestones, certs in order, portfolio projects, and India salary ranges.

Jun 30, 2026

Career11 min

AWS Cloud Security Salary in India 2026: Roles, Ranges, Negotiation

A realistic look at cloud security salary in India for 2026 — ranges by role, city, and certification stack, MNC vs startup pay structures, and how to negotiate.

Jun 30, 2026

Career14 min

Cybersecurity Internship in India 2026: How to Land a Cloud Security Role

A practical guide to landing a cybersecurity internship in India in 2026 — what employers want, where to find roles, how to interview, and the portfolio that gets replies.

Jun 30, 2026

Compliance15 min

DPDP Act Compliance Checklist for Indian SaaS Companies (2026)

A practical DPDP Act 2023 compliance checklist for Indian SaaS — obligations explained, a 12-item action list, penalties, and how DPDP compares to GDPR.

Jun 30, 2026

Compliance13 min

DPDP vs GDPR: What Indian Companies Selling Globally Must Know

A side-by-side DPDP vs GDPR comparison across 14 dimensions — scope, consent, rights, breach notification, penalties, and the practical posture for Indian SaaS.

Jun 30, 2026

AI Security14 min

AI/LLM Security Checklist: OWASP LLM Top 10 Mapped to AWS Bedrock

A practitioner's LLM security checklist that walks every OWASP LLM Top 10 risk and maps each to the AWS Bedrock control that actually mitigates it in production.

Jun 30, 2026

AI Security13 min

RAG Security: Protecting Vector Databases and Embedding Pipelines

A practitioner's RAG security guide — corpus poisoning, indirect prompt injection via retrieved docs, embedding inversion, tenant isolation, and concrete defences for OpenSearch, pgvector, and Pinecone.

Jun 30, 2026

Cloud Security16 min

AWS Solutions Architect Associate (SAA-C03) — Security Domain Deep Dive

A practitioner's breakdown of the SAA-C03 security domain — what's in scope, what isn't, the question patterns AWS reuses, and a 4-week focused prep slice for the 30% that makes or breaks the exam.

Jun 30, 2026

Cloud Security14 min

AWS Security Specialty (SCS-C03) Domain 2 Logging Lab — updated from SCS-C02

Build the SCS-C03 logging domain in your hands — a step-by-step walkthrough of an Athena-backed detection pipeline plus the exact mental model AWS expects on every Domain 2 question. Updated from SCS-C02.

Jun 30, 2026

Cloud Security22 min

AWS Security Specialty (SCS-C03) Practice Questions — updated from SCS-C02

Fifty original SCS-C03 practice questions written in the style of the real AWS Security Specialty exam, weighted by domain, with detailed explanations for every answer. Updated from SCS-C02.

Jun 30, 2026

Cloud Security16 min

AWS Security Specialty (SCS-C03) Study Guide — updated from SCS-C02

A practitioner's SCS-C03 study guide — every domain mapped to the services it really tests, the gotchas the exam loves, and free hands-on AWS labs you can use to build console-time before exam day. Updated from SCS-C02.

Jun 30, 2026

AI Security13 min

Securing AI Agents: Tool-Use, MCP, and Least-Privilege Patterns

An AI agent security guide covering the agent threat model, MCP server risks, least-privilege tool design, and concrete patterns for Bedrock Agents and Claude Code as agent runtimes.

Jun 30, 2026

AI Security12 min

Securing GitHub Copilot, Cursor, and Claude Code in Enterprise Codebases

An enterprise playbook for securing AI coding assistants — what each tool sends to its provider, how to scope what they see, secret-leakage prevention, supply-chain risk, and a policy template.

Jun 30, 2026

AI Security13 min

Securing Amazon Bedrock: IAM, Guardrails, and Data Isolation in Production

A production-grade Amazon Bedrock security guide — IAM least privilege, Guardrails configuration, VPC endpoints, KMS encryption, and CloudTrail data events with concrete IAM JSON.

Jun 30, 2026

Career16 min

From Zero to SOC Analyst: A 12-Week Self-Study Plan with Free Labs

A free 12-week SOC analyst roadmap — weekly milestones, the free tools to practise on, home-lab setup, interview prep, and how to land your first SOC role in India.

Jun 30, 2026

Cloud Security9 min

From SSRF to Stolen EC2 Role Credentials: Killing the IMDSv1 Attack Chain

How an SSRF bug becomes full IAM-role credential theft through the instance metadata service, and how to enforce IMDSv2 org-wide with SCPs, condition keys, and GuardDuty detection.

Jun 6, 2026

Cloud Security7 min

IAM least-privilege without breaking production

How to cut over-broad AWS permissions methodically — driven by what your workloads actually do — without taking prod down.

Jun 4, 2026

Cloud Security6 min

Secure S3: the settings that stop a data leak

Almost every S3 breach is a misconfiguration, not a hack. Here are the few settings that prevent nearly all of them.

Jun 2, 2026

Detection & Response10 min

Reconstructing a Data-Exfiltration Breach from CloudTrail with Athena

When an S3 bucket leaks, your CloudTrail logs already hold the full story. Here is how to query them with Athena, pivot across identity and network signals, and rebuild the attacker's timeline from first API call to final GetObject.

Jun 1, 2026

Cloud Security8 min

Respond to a leaked AWS access key — fast

A step-by-step incident playbook for a leaked AWS key: contain, scope the blast radius, eradicate, and prevent the next one.

May 30, 2026

Detection & Response9 min

Which GuardDuty Findings Actually Matter, and How to Auto-Respond

GuardDuty emits hundreds of finding types, but only a handful warrant a pager. A working engineer's guide to separating high-signal compromise indicators from recon noise, writing suppression rules that don't blind you, and wiring EventBridge to Lambda and SSM for automated containment.

May 27, 2026

Cloud Security10 min

KMS Key Policies, Grants, and Secure Cross-Account Encryption

A deep, practical guide to AWS KMS authorization: how key policies, IAM, and grants actually interact, and how to build least-privilege cross-account encryption that holds up under review.

May 22, 2026

Cloud Security11 min

A Practical SCP Guardrail Library for AWS Organizations

A field-tested set of Service Control Policies that cap what any account can do, with exception patterns that survive break-glass and CI/CD reality. Copy, scope, deploy.

May 17, 2026

Cloud Security9 min

Cross-Account IAM Roles Done Right: ExternalId, aws:SourceArn, and the Confused Deputy

A working engineer's guide to hardening cross-account trust policies against the confused-deputy problem, with the exact conditions that separate a safe vendor integration from a tenant-isolation breach.

May 12, 2026

Cloud Security10 min

VPC Network Security Deep-Dive: Flow Logs, Security Groups vs NACLs, and Egress Filtering

A working engineer's guide to locking down VPC traffic: where stateful security groups beat stateless NACLs, why default-allow egress is a data-exfiltration liability, and how to hunt anomalous outbound flows in CloudWatch Logs Insights.

May 7, 2026

Cloud Security11 min

Container Security on AWS: ECR Scanning, ECS Hardening, and EKS Controls

A practitioner's walkthrough of locking down the container lifecycle on AWS, from Inspector-backed ECR scanning and image signing to ECS task-role isolation, IMDS exposure, EKS IRSA and Pod Identity, and GuardDuty Runtime Monitoring.

May 2, 2026

Cloud Security9 min

Serverless Security: Least-Privilege Lambda, Event Injection, and Secrets Handling

Serverless removes the host you used to patch, but it does not remove the attack surface. This is how working engineers harden Lambda execution roles, untrusted event sources, secrets, and Function URLs against real exploitation.

Apr 27, 2026

Detection & Response10 min

AWS Detection Engineering: High-Signal Rules from CloudTrail and GuardDuty

A practical method for turning CloudTrail and GuardDuty into detections that fire on real attacker behavior, not noise. We map TTPs to ATT&CK, baseline normal, enrich for context, and wire findings to automated response.

Apr 22, 2026

Cloud Security8 min

Secrets Management on AWS: Secrets Manager vs SSM Parameter Store, Rotation, and Killing Hardcoded Credentials

A deep, engineer-grade comparison of AWS Secrets Manager and SSM Parameter Store: rotation, KMS, least-privilege retrieval, and how to detect secret access in CloudTrail.

Apr 17, 2026

Detection & Response11 min

Cloud Incident Response on AWS: Isolation, Snapshots, and Evidence Preservation

A field-tested AWS incident response playbook for working engineers: contain a compromised instance and credentials, preserve EBS and CloudTrail evidence in a forensic account, and investigate without tipping off the attacker.

Apr 12, 2026

Detection & Response9 min

Attacking and Defending IAM Identity Center: Permission Sets, Persistence, and Detection

How Identity Center maps humans to accounts via permission sets and assignments, what an attacker does with a compromised identity source or delegated admin, and the sso.amazonaws.com and sso-directory events that catch them.

Apr 7, 2026

Cloud Security9 min

Ransomware in the Cloud: S3 and EBS Threat Models, Immutability, and Recovery

Cloud ransomware rarely encrypts files in place. It re-keys your S3 objects with the attacker's KMS material, deletes your snapshots, and turns off the safety nets first. Here is the threat model and the immutability controls that survive a compromised admin.

Apr 2, 2026

Cloud Security9 min

AWS WAF and Shield: Real Application Protection Beyond Default Rules

Default managed rules and Shield Standard are table stakes, not a strategy. Here is how to design a WAF web ACL that actually blocks attacks without breaking your app or your budget.

Mar 28, 2026

Want this hands-on, not just read?

Jump into a real AWS security lab, or explore our training tracks.

Start the free lab

Explore all tracks