Cloud › Module 8 › Lesson 1
CSPM Named
CSPM literacy — Cloud Security Posture Management findings category, misconfig rules, compliance mapping — on `$CLOUD_LAB` account stubs.
Visual · t31_cspm_named
CSPM = named posture finding rows. $CLOUD_LAB. Original Cyberlium.
Opening
CSPM tools surface misconfigs you missed in console — name finding fields on YOUR lab account stubs before trusting prod dashboards alone.
Cloud Security Posture Management (CSPM) literacy names: posture scanner category (AWS Security Hub/Config, Azure Defender literacy stubs), finding severity, resource ID, misconfig rule name (public S3 category, open SG category), compliance framework mapping category, and remediation owner stub. Analyst triages three CSPM-style findings on `$CLOUD_LAB` instructor account stub or YOUR sandbox — documents defender disposition — without scanning stranger AWS/Azure tenants, without auto-remediating prod without RoE, without dismissing critical public exposure. Cyberlium links Modules 2–5 shared responsibility and IAM — posture at account level. Refused: unauthorized prod tenant scan, stranger account enumeration, disabling CSPM to hide findings. Lab row: CSPM finding table (rule, resource, severity, fix category) three rows.
1. Named CSPM fields
Rule name, resource ID, severity, compliance map, owner — five literacy anchors.
Finding ties to shared responsibility row — customer vs CSP fix category.
Command guide
Try these commands — Named CSPM fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CSPM overview — https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management AWS Security Hub — https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html NIST cloud — https://csrc.nist.gov/publications/detail/sp/800-144/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
curl -sS https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html | head -10
cat > "$CLOUD_LAB/tools/cspm-named-literacy.txt" <<'EOF'
CSPM literacy (YOUR accounts — named tools, no stranger org prowler):
AWS: Security Hub, Config, Access Analyzer aggregate findings
Azure: Defender for Cloud CSPM recommendations
Open: Prowler/ScoutSuite on YOUR account with explicit authorization
NEVER: prowler/scout against stranger orgs or leaked credentials
EOFCommand — copy this
grep -E 'CSPM|NEVER|YOUR account' "$CLOUD_LAB/tools/cspm-named-literacy.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: CSPM overview (https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management); AWS Security Hub (https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html); NIST cloud (https://csrc.nist.gov/publications/detail/sp/800-144/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage disposition
Remediate-now vs ticket vs accept-with-compensating-control — document UTC.
Public exposure findings default remediate-now on lab stub literacy.
3. Refused
No stranger tenant scan; no CSPM disable to hide misconfigs.
CSPM literacy supports posture — not unauthorized reconnaissance.
4. What you ship: CSPM finding table
Three finding rows + disposition + NEVER stranger tenant scan line.
5. What you record before the next lesson
CSPM finding table path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run CSPM scan against stranger AWS organization as 'research.'
Right
CSPM finding table from `$CLOUD_LAB` account stub. Next: CWPP Named.
Mission: CSPM finding table
1) Name five CSPM finding fields. 2) Three finding rows from lab stub. 3) Disposition per row UTC. 4) Write NEVER stranger tenant scan line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Public S3 finding — default disposition?”
Knowledge Check
APPLY: CSPM literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Scanning stranger cloud tenants is lab.
True or False
Knowledge Check
APPLY: CSPM finding includes:
Multiple choice