This page is the long version of the Learn menu. The menu carries the entry points: foundations, the three providers, and the hands-on builds. Everything else lives here, because a menu that lists every topic stops being a menu.
Two neighbouring things are deliberately not on this list. News, threat research and the breach kill chains are current events rather than reference material, and live under Threat Intel. What practitioners think reports what the Friday room said about a topic, which is a different kind of page from a guide to it.
On this page
Foundations
Start here if the vocabulary is still settling. These pages cover what everything else on this list assumes you already know.
What is Cloud Security?
The starting point: what the term covers, which threats actually matter, and how the tool categories fit together.
Shared Responsibility
Where the provider's job ends and yours begins across AWS, Azure, GCP and SaaS, with the gotchas spelled out.
CSPM vs CNAPP
What CSPM, CNAPP, CWPP, CIEM and DSPM each mean, where they overlap, and when you need which.
Best Practices
The controls that prevent breaches, ranked by what shows up as root cause in real incident reports.
Vendor Landscape
An opinion-free map of the vendor space by category. No rankings, no quadrants, no scores.
Glossary
Cloud security terms in plain English, searchable, from ABAC to zero trust.
FAQ
What CSOH is, how the free Friday session works, and how to contribute to the site.
By cloud provider
The same problems, three different service catalogs. Each guide covers that provider's own model rather than translating another's.
AWS Security
The Well-Architected security pillar and the service catalog: GuardDuty, Security Hub, IAM, KMS, WAF and Macie.
Azure Security
Microsoft's responsibility split, the Cloud Adoption Framework secure methodology, and the Defender and Entra stack.
GCP Security
Google's responsibility split, the differentiators (BeyondCorp, Titan) and what encryption by default does and does not cover.
AWS vs Azure vs GCP
Side by side on identity, detection, data protection, network and compliance.
Workloads
Where your code actually runs, and what changes about securing it in each shape.
Containers
Why cloud workloads run in containers and what breaks: escapes, identity chaining, and the image supply chain.
Kubernetes
The threat model for EKS, AKS and GKE, the responsibility split for managed control planes, and pod escape paths.
Serverless
Lambda, Azure Functions and Cloud Functions: why they are attractive, and where the model fails.
Service Mesh
Securing east-west traffic inside Kubernetes with Istio, Linkerd, Cilium and Consul Connect.
CI/CD
Pipeline anatomy, OIDC-based cloud authentication, deployment strategies, and how the three toolchains compare.
Landing Zones
What a landing zone is, the building blocks every one has, and the three providers' reference implementations.
Identity and access
The category that shows up as root cause more than any other.
IAM and Cloud Identity
Identity types, federation and SSO (SAML, OIDC, SCIM), RBAC, and the privilege paths that get abused.
Non-Human Identity
Service accounts, API keys, tokens, workload identities and AI agents, plus how to discover and detect them.
Zero Trust
What it actually is, and is not: the NIST SP 800-207 tenets, the BeyondCorp origin story, and ZTNA versus VPN.
Data, network and applications
The three surfaces attackers reach for once identity has held.
Data Security and KMS
Encryption at rest and in transit, envelope encryption, BYOK and HYOK, HSMs, and secrets management.
Network Security
VPC and VNet design, private endpoints, egress control, WAF and DDoS.
API Security
The OWASP API Security Top 10, auth patterns (OAuth, OIDC, JWT, mTLS), and authorization with OPA or Cedar.
SaaS Security (SSPM)
Posture management for Microsoft 365, Google Workspace, Salesforce and Slack: the surface nobody owns.
Threats and resilience
Finding the weaknesses before someone else does, and surviving the day they are used.
Threat Modeling
STRIDE, PASTA, LINDDUN, attack trees and kill-chain models, applied to cloud architectures.
Vulnerability Management
CVE, CVSS, EPSS and KEV, reachability analysis, and the scanner alphabet (SAST, SCA, DAST).
Backup, DR and Ransomware
Why backup became a security control: the 3-2-1-1-0 rule, RTO and RPO, and immutability.
Detection and response
The operational side. These four also sit under Threat Intel in the menu, alongside the news and breach coverage.
Cloud SOC
How detection works when there are no packets to capture, and the log sources you actually need.
Detection Engineering
The detection lifecycle from research through tuning to retirement, built on CloudTrail and its equivalents.
Incident Response
NIST SP 800-61 and SANS PICERL adapted to cloud, and what forensics looks like with no disk to image.
Cloud Pentesting
AWS, Azure and GCP attack paths, plus Pacu, ROADtools, BloodHound and privilege escalation chains.
Governance and compliance
The paperwork that turns out to drive engineering priorities.
AI
Two directions at once: securing AI systems, and using AI in security work.
AI Learning
A roadmap for cloud security people learning AI: fundamentals, prompt engineering, agentic systems and hands-on labs.
AI/ML Security
The OWASP LLM Top 10, prompt injection, model supply chain, MLOps security, RAG and vector databases.
MCP Security
How Model Context Protocol works, its attack surface, and concrete defenses for agents that call tools.
Build it
Reference material that is also running infrastructure. Every one of these documents something this site actually does.
Multi-Cloud Secure Deploy
How this site serves active/active from AWS, GCP and Azure behind Cloudflare, with keyless OIDC deploys.
GitHub Actions
Triggers, concurrency, secrets, and PAT versus GITHUB_TOKEN, shown through CSOH's real workflows.
Terraform
Providers, state, variables and outputs, shown through real commented IaC across four providers.
Git and Version Control
Git from the staging model up, then how CSOH uses branches and pull requests and keeps secrets out of history.
Where next
An index is a starting point, not a reading order. If you do not know which of these you need, these are the faster routes in.
- Learning path - the same material sequenced, beginner through working practitioner, rather than grouped by subject.
- Resource directory - 480+ curated third-party tools, labs, certifications and CTFs, filterable by category.
- Glossary - if a page above assumed a term you do not have yet.
- What practitioners think - what the Friday sessions actually concluded about several of these topics, disagreements included.
- Friday Zoom sessions - free, weekly, no pitch. The fastest way to get a question answered by people who do this for a living.