DevSecOps

Cloud Security Controls

Five control domains on every account, each with the cloud's own services, and every finding in one view.

NGT designs cloud security in five domains: management, identity and application, data, infrastructure, and cyber defence. Each domain uses the cloud's own services first and partner tools where they add something. Every finding flows to one posture view with an owner.

federationfindingsSecurity managementIdentity & accessApplication securityData securityCloud infrastructure securityCyber defence · an outside-in viewAWS Config & SCPscompliance as codeAWS Security Hubone view of findingsSecurity assessmentbefore go-liveAWS ManagedMicrosoft ADuser storeIAM Identity CenterSSO · MFAPrivileged accesstime-boxedPipeline rolesone eachAmazon CloudFrontDDoS protectionAWS WAFOWASP rulesAmazon API Gatewayauth · throttlingAWS Secrets Managerapp secretsIn transitTLS everywhereAWS KMSat restAccess by roleper projectAmazon VPCsecurity zonesAWS Network Firewallinspected trafficAWS Systems Managerhardened imagesAWS CloudTrailaudit trailAmazon GuardDutySIEMInvestigationroot causePlaybooksautomated responsePenetration testsplannedAmazon Inspectorvulnerability mgmtEndpoint securitypartner tools

Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.

When to use it

  • A regulated workload: ISO 27001, PCI DSS, HIPAA or GDPR controls to evidence
  • Many accounts hardened by hand, each a little differently
  • Security findings spread over consoles nobody reads

How NGT delivers it

Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.

DevSecOps