How Does Cybersecurity I S O Work And Its Core Mechanisms

Implementation Framework for ISO/IEC 27001: Step-by-Step Process and Interdependencies

10-Step Implementation Process for ISO/IEC 27001

"ISO/IEC 27001 is not a one-time project but a continuous cycle of improvement, requiring iterative reviews and adjustments." — ISO/IEC 27001:2022, Clause 10.1

1. Leadership Commitment and Policy Establishment
   Senior management must formally endorse the Information Security Management System (ISMS) by defining a Statement of Applicability (SoA) and allocating resources. This includes:
   • Appointing an ISMS owner (e.g., Chief Information Security Officer, CISO).
   • Developing an ISMS policy aligned with business strategy.
   • Ensuring compliance with legal/regulatory obligations (e.g., GDPR, HIPAA).
2. Scope Definition and Context Analysis
   The ISMS scope must be clearly defined, considering:
   • Geographical boundaries (e.g., data centers, remote offices).
   • Processes and assets (e.g., IT systems, third-party vendors).
   • External/internal issues (e.g., cyber threats, regulatory changes).
   A context analysis (per ISO 27001:2022 Clause 4.1) identifies stakeholders, their needs, and constraints.
3. Risk Assessment and Treatment
   Conduct a risk assessment using ISO/IEC 27005 guidelines, focusing on:
   • Asset identification (e.g., intellectual property, customer data).
   • Threat and vulnerability analysis (e.g., phishing, insider risks).
   • Risk evaluation (likelihood × impact) to prioritize controls.
   Risk treatment options include avoidance, reduction, transfer, or acceptance.
4. Statement of Applicability (SoA) Development
   The SoA documents selected ISO/IEC 27002 controls, justifying exclusions based on risk assessment. Key considerations:
   • Control applicability (e.g., A.9 for access control, A.12 for operational security).
   • Custom controls where standard controls are insufficient.
   • Legal/regulatory mandates (e.g., encryption for PCI DSS compliance).
5. Documentation and Process Design
   Develop ISMS procedures, records, and evidence to support:
   • Operational controls (e.g., incident response plans).
   • Management controls (e.g., risk treatment plans).
   • Compliance documentation (e.g., audit trails, access logs).
   ISO/IEC 27001:2022 Clause 7.5 requires documented processes for monitoring, measurement, internal audit, and management review.
6. Implementation of Controls
   Deploy controls based on the SoA, ensuring:
   • Technical controls (e.g., firewalls, encryption).
   • Physical controls (e.g., access badges, server room security).
   • Organizational controls (e.g., security awareness training).
   Example: For A.12.6.1 (Information Security Awareness), implement mandatory training programs with measurable outcomes.
7. Internal Audit and Corrective Actions
   Conduct internal audits (per ISO 19011) to verify control effectiveness. Steps include:
   • Audit planning (scope, objectives, criteria).
   • Evidence collection (interviews, document reviews).
   • Non-conformance reporting and corrective actions (CA).
   ISO 27001:2022 Clause 9.2 mandates audit frequency (typically annual).
8. Management Review
   Senior management reviews ISMS performance, risk status, and improvements (per Clause 9.3). Key review areas:
   • Effectiveness of controls (e.g., incident reduction metrics).
   • Changes in external/internal context (e.g., new threats).
   • Resource allocation (budget, personnel).
   Output: Updated ISMS policy, objectives, and risk treatment plans.
9. Certification Audit Preparation
   Engage a certification body (CB) for a Stage 1 (documentation review) and Stage 2 (on-site audit). Preparation includes:
   • Gap analysis (addressing audit findings).
   • Mock audits to simulate CB assessments.
   • Evidence compilation (e.g., risk assessments, audit trails).
   Certification duration: Typically 3 years, with annual surveillance audits.
10. Continuous Improvement and Maintenance
    Post-certification, maintain ISMS through:
    • Monitoring and measurement (KPIs, dashboards).
    • Internal audits (bi-annual or as needed).
    • Management reviews (annual).
    • Incident response improvements (e.g., lessons learned).
    ISO 27001:2022 Clause 10.1 emphasizes continuous improvement via the Plan-Do-Check-Act (PDCA) cycle.

ISO/IEC 27001 Gap Analysis: Step-by-Step Procedure

"A gap analysis is not a compliance exercise but a risk mitigation strategy to align security posture with business objectives." — ISO/IEC 27005:2022, Risk Management Guidelines

1. Define Scope and Objectives
   Establish the scope (e.g., IT systems, HR processes) and objectives (e.g., certification readiness, regulatory compliance). Key inputs:
   • ISO/IEC 27001:2022 clauses (e.g., 5.1.1 leadership commitment).
   • Current security policies (e.g., IT security manuals).
   • Regulatory requirements (e.g., GDPR Article 32).
2. Benchmark Against ISO/IEC 27001 and 27002
   Compare existing controls against:
   • ISO/IEC 27001:2022 Annex A controls (e.g., A.5 for access control).
   • ISO/IEC 27002:2022 best practices (e.g., A.12.6.1 for awareness training
     

     Risk Management and Compliance Mechanisms in ISO/IEC 27001

     The ISO/IEC 27001 standard establishes a systematic approach to managing information security risks by integrating risk assessment, treatment, and continuous monitoring. At its core, ISO/IEC 27005 provides a structured methodology for risk assessment, balancing qualitative and quantitative techniques to align security investments with organizational objectives. This section explores the methodology’s application, including asset valuation, threat modeling, and the development of risk treatment plans. Additionally, it contrasts ISO/IEC 27001’s risk management framework with the NIST Risk Management Framework (RMF), highlighting procedural distinctions and deliverables. A case study further illustrates how ISO 27001 controls were implemented to mitigate a high-risk vulnerability, demonstrating real-world effectiveness.
     

     ISO/IEC 27005 Risk Assessment Methodology: Qualitative vs. Quantitative Approaches

     ISO/IEC 27005 defines risk as the combination of the likelihood of an event and its impact, structured into three phases: context establishment, risk assessment, and risk evaluation. The methodology supports both qualitative (non-numeric) and quantitative (numeric) approaches, with the choice depending on organizational resources, complexity, and regulatory requirements.

     Qualitative Risk Assessment relies on expert judgment, historical data, and predefined scales (e.g., low/medium/high) to evaluate risk. It is cost-effective and suitable for organizations with limited data or resources. Key steps include:
     

   • Asset Identification: Cataloging information assets (e.g., databases, intellectual property) and their criticality using criteria such as confidentiality, integrity, and availability (CIA triad).
   • Threat and Vulnerability Analysis: Mapping potential threats (e.g., phishing, insider threats) to vulnerabilities (e.g., unpatched software) using frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege).
   • Risk Estimation: Assigning likelihood (e.g., rare, occasional, frequent) and impact (e.g., minor, major, catastrophic) based on predefined matrices. Example:

   Risk Level = Likelihood × Impact
   (Qualitative: High = High Likelihood + High Impact) Quantitative Risk Assessment uses numerical values (e.g., Single Loss Expectancy, Annualized Rate of Occurrence) to prioritize risks objectively. It requires historical loss data or probabilistic models. Steps include:
   
   • Asset Valuation: Assigning monetary or operational value to assets (e.g., $500,000 for a customer database).
   • Threat Probability Calculation: Estimating the annualized frequency of threats (e.g., 0.2 incidents/year for a DDoS attack).
   • Impact Quantification: Measuring potential losses (e.g., $100,000 per breach for a financial institution).
   • Risk Calculation: Applying formulas such as:

   Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO)
   ALE = (Asset Value × Exposure Factor) × ARO Example: If a server valued at $200,000 has a 30% exposure factor (potential loss of $60,000) and a 0.1 ARO, the ALE is $6,000/year.

   Threat Modeling Integration: Threat modeling (e.g., Microsoft’s STRIDE, PASTA) complements risk assessment by visually mapping threats to system components. For instance, a Data Flow Diagram (DFD) identifies attack surfaces, while attack trees break down threat scenarios (e.g., "How could an attacker exfiltrate data?").
   

   Risk Treatment Plan Template Aligned with ISO/IEC 27001 Annex A

   A risk treatment plan documents selected controls from ISO/IEC 27001 Annex A to reduce risks to an acceptable level. The plan must include residual risk acceptance criteria (e.g., "Risk must be reduced to ≤ Medium"). Below is a structured template:

   Context:
   Risk treatment plans are developed after risk assessment and evaluation, ensuring alignment with organizational risk appetite. Controls are selected based on cost-effectiveness, feasibility, and compliance with Annex A clauses (e.g., A.9.1.1 for access control policies).

   Template for Risk Treatment Plan:
   

   • Risk Identifier: Unique reference (e.g., "RISK-2024-001").
   • Description of Risk: Concise statement of the threat, vulnerability, and potential impact.
   Example: "Unauthorized access to the HR database via weak authentication controls could lead to data leakage, violating GDPR (Article 5)."
   • Risk Level (Before Treatment): Qualitative/quantitative classification (e.g., High/Medium/Low or ALE = $15,000).
   • Risk Acceptance Criteria: Residual risk threshold post-treatment (e.g., "Acceptable if reduced to Medium or below").
   • Treatment Strategy: One or more of the following:
   • Mitigation: Implementing controls (e.g., multi-factor authentication, encryption).
   • Avoidance: Eliminating the risk source (e.g., discontinuing a high-risk service).
   • Transfer: Sharing risk via insurance or outsourcing (e.g., cloud-based security services).
   • Acceptance: Formal acknowledgment of residual risk with justification.
   • Selected Controls (Annex A References):
   • A.9.1.1: Access control policy.
   • A.12.4.1: Information systems audit logging.
   • A.14.1.2: Secure development lifecycle for software.
   • Implementation Timeline: Phased rollout (e.g., "Phase 1: Q3 2024, Phase 2: Q1 2025").
   • Responsible Party: Owner (e.g., "IT Security Team") and stakeholders.
   • Residual Risk Assessment: Post-implementation evaluation to verify effectiveness.
   • Monitoring and Review: Frequency (e.g., "Annual review" or "Trigger-based after incidents").

   Example Entry:

   Risk Identifier: RISK-2024-005
   Description: Physical theft of laptops containing unencrypted customer PII from an off-site meeting.
   Risk Level: High (Likelihood: Occasional; Impact: Major)
   Acceptance Criteria: Residual risk ≤ Medium.
   Treatment Strategy: Mitigation (A.12.1.1, A.13.1.1)
   Selected Controls:
   

   A.12.1.1: Physical and environmental security perimeter controls (e.g., GPS tracking, full-disk encryption).

   A.13.1.1: Information security awareness training for employees.

   Timeline: Encryption deployed by EOY 2024; training completed by Q1 2025.
   Residual Risk: Medium (Likelihood reduced to Rare; Impact remains Major but mitigated by encryption).
   Owner: Facilities and IT Security Teams.
   Review: Quarterly until risk is accepted.

   Comparison of ISO/IEC 27001 Risk Management and NIST RMF

   While both frameworks aim to manage information security risks, they differ in structure, processes, and deliverables. Below is a side-by-side comparison focusing on risk management methodologies:
   

   Aspect	ISO/IEC 27001 (ISO 27005)	NIST Risk Management Framework (RMF)
   Framework Purpose	Provides a risk-based approach to ISMS (Information Security Management System) implementation, emphasizing continuous improvement and compliance with Annex A controls.	Offers a lifecycle-driven approach for federal systems (e.g., FISMA compliance), structured around six steps: Identify, Protect, Detect, Respond, Recover, and Prepare.
   Risk Assessment Methodology	Supports qualitative (expert judgment) and quantitative (ALE/SLE) methods. Uses ISO 27005 as a standalone standard for risk assessment. Focuses on asset valuation and threat modeling (e.g., STRIDE, DFD).	Primarily qualitative with optional quantitative elements (e.g., risk scoring matrices). Technical and Operational Controls in ISO/IEC 27001 ISO/IEC 27001 establishes a structured framework for implementing technical and operational controls to mitigate information security risks. These controls, derived from ISO/IEC 27002 Annex A (A.12–A.14), address vulnerabilities in systems, networks, and processes while ensuring alignment with organizational objectives. Technical controls focus on digital safeguards, while operational controls integrate human and procedural elements to enforce security policies. Below are key technical controls, implementation best practices, and decision-making frameworks for physical controls, alongside compliance intersections with major regulations. Technical Controls in ISO/IEC 27002 (A.12–A.14) and Implementation Best Practices Technical controls automate or enforce security measures to protect information assets from cyber threats. The following 10 controls (selected from Annex A) are critical for modern infrastructures, with implementation guidance tailored to scalability and risk reduction. Key Principle: Technical controls should be defense-in-depth, redundant, and integrated with monitoring to detect anomalies. Access Control Systems and Access Management (A.9) Restricts unauthorized access to systems, data, and applications based on user roles and authentication mechanisms. Implementation Best Practices: Deploy Role-Based Access Control (RBAC) with least-privilege principles (e.g., AWS IAM, Microsoft Azure AD). Enforce Multi-Factor Authentication (MFA) for all administrative and privileged accounts (e.g., Duo Security, Google Authenticator). Use Attribute-Based Access Control (ABAC) for dynamic environments (e.g., Kubernetes RBAC with Open Policy Agent). Regularly audit access logs via SIEM tools (e.g., Splunk, IBM QRadar) to detect brute-force or credential stuffing attempts. Real-World Example: Equifax’s 2017 breach was exacerbated by unpatched vulnerabilities and weak access controls. Post-incident, the company implemented just-in-time (JIT) access for privileged accounts, reducing lateral movement risks by 87%. Cryptographic Controls (A.12) Protects data confidentiality and integrity through encryption, key management, and digital signatures. Implementation Best Practices: Use AES-256 for data-at-rest encryption (e.g., BitLocker, LUKS) and TLS 1.3 for data-in-transit (e.g., Cloudflare, Let’s Encrypt). Implement Hardware Security Modules (HSMs) (e.g., Thales, AWS CloudHSM) for cryptographic key storage in high-risk environments. Enforce key rotation policies (e.g., 90-day rotation for symmetric keys, 1-year for asymmetric keys) using tools like HashiCorp Vault or AWS KMS. Validate encryption compliance via penetration testing (e.g., Burp Suite, OpenVAS) and static code analysis (e.g., SonarQube). Regulatory Alignment: GDPR (Article 32) mandates pseudonymization and encryption for personal data. PCI DSS (Requirement 3) requires strong cryptography for cardholder data. Operating System Security (A.12.3) Secures system configurations, patch management, and user activities to prevent exploits. Implementation Best Practices: Deploy Configuration Management Databases (CMDBs) (e.g., ServiceNow, Chef) to enforce CIS Benchmarks (e.g., CIS Microsoft Windows Server Level 1). Automate patch management using WSUS (Windows) or Spacewalk (Linux) with change windows to minimize downtime. Disable unnecessary services (e.g., SMBv1, Telnet) and enable Windows Defender Exploit Guard or SELinux/AppArmor on Linux. Monitor system logs centrally via SIEM (e.g., ELK Stack) to detect privilege escalation or rootkit activity. Case Study: In 2020, SolarWinds’ supply-chain attack leveraged unpatched Orion software. Post-breach, organizations adopted immutable infrastructure (e.g., AWS Graviton) and binary authorization (e.g., Google Binary Authorization) to enforce signed, unalterable deployments. Technical Vulnerability Management (A.12.6) Identifies and mitigates vulnerabilities in software, hardware, and networks proactively. Implementation Best Practices: Conduct weekly vulnerability scans (e.g., Nessus, Qualys) with CVSS scoring to prioritize fixes (e.g., Critical ≥ 9.0). Integrate Static Application Security Testing (SAST) (e.g., Checkmarx) and Dynamic Analysis (DAST) (e.g., OWASP ZAP) into CI/CD pipelines. Use Threat Intelligence Feeds (e.g., MISP, AlienVault OTX) to correlate vulnerabilities with active exploits (e.g., CVE-2021-44228/Log4j). Maintain a Vulnerability Management Database (VMDB) with remediation timelines (e.g., 30 days for Critical, 90 for High). Compliance Note: PCI DSS (Requirement 6) requires quarterly external vulnerability scans and quarterly internal scans. ISO 27001 aligns by mandating continuous monitoring (A.12.1.1). Information Systems Audit Logging and Monitoring (A.12.4) Generates and analyzes logs to detect, investigate, and respond to security incidents. Implementation Best Practices: Enable comprehensive logging (e.g., Windows Event Logs, Linux syslog, firewall logs) with immutable storage (e.g., AWS CloudTrail Lake). Deploy SIEM solutions (e.g., Splunk, Datadog) with correlation rules for anomalies (e.g., failed logins, unusual data exfiltration). Implement UEBA (User and Entity Behavior Analytics) (e.g., Microsoft Defender for Identity) to detect insider threats or compromised accounts. Retain logs for at least 1 year (GDPR) or 6 years (PCI DSS) with log integrity checks (e.g., hash verification). Log Sources to Monitor: Certification and Continuous Improvement in ISO/IEC 27001 ISO/IEC 27001 certification validates an organization’s commitment to implementing an Information Security Management System (ISMS) aligned with global best practices. The certification process involves structured audits, documentation reviews, and continuous monitoring to ensure compliance and effectiveness. Beyond initial certification, maintaining alignment with evolving threats and regulatory requirements demands systematic improvement mechanisms, including internal audits, key performance indicators (KPIs), and management oversight. The certification journey begins with rigorous audits conducted by accredited certification bodies, followed by periodic surveillance to sustain compliance. Internal audits, guided by ISO 19011, serve as a critical tool for identifying gaps and driving corrective actions. Measuring the ISMS’s impact through KPIs provides quantifiable evidence of progress, while management reviews ensure strategic alignment. This section outlines the audit stages, internal audit structures, performance metrics, and continuous improvement frameworks essential for sustained ISO/IEC 27001 success. Stages of ISO/IEC 27001 Certification Audit The ISO/IEC 27001 certification audit is a multi-phase process conducted by an accredited certification body, typically spanning 6–12 months from initial application to final certification. The process includes pre-assessment, Stage 1 (documentation review), Stage 2 (implementation audit), and surveillance visits to ensure ongoing compliance. Pre-Assessment Phase Organizations must first demonstrate readiness by: Completing an ISMS implementation (aligned with ISO/IEC 27001 and ISO/IEC 27002). Developing mandatory documentation, including: Statement of Applicability (SoA) for controls. Risk treatment plans and risk assessments. Security policies, procedures, and records. Evidence of control implementation (e.g., access logs, encryption protocols). Conducting an internal audit and management review to identify gaps. Selecting an accredited certification body (e.g., BSI, DNV, LRQA) and submitting an application with scope definition. Stage 1 Audit (Documentation Review) Duration: 1 day (on-site or remote). Objective: Verify the completeness and alignment of ISMS documentation with ISO/IEC 27001 requirements. Key Activities: Review of the ISMS scope, policies, and risk treatment methodology. Validation of SoA and evidence of control selection. Assessment of risk assessment processes and treatment decisions. Evaluation of management commitment (e.g., leadership involvement, resource allocation). Outcome: Issuance of a Stage 1 report with non-conformities (if any) that must be addressed before Stage 2. Stage 2 Audit (Implementation Audit) Duration: 2–5 days (depending on organization size and complexity). Objective: Confirm that the ISMS is effectively implemented, maintained, and continually improved. Key Activities: Control effectiveness testing: Auditors verify operational controls (e.g., access management, incident response, asset inventory). Interviews: Stakeholders (e.g., IT, HR, security teams) are interviewed to assess awareness and compliance. Process sampling: Auditors review records (e.g., audit logs, training attendance, corrective actions) for compliance. Risk management review: Validation of risk treatment plans and residual risk acceptance. Outcome: Final audit report with non-conformities (major/minor). If resolved, certification is granted for 3 years. Surveillance Audits Frequency: Annual visits (typically 3 surveillance audits within the 3-year certification cycle). Duration: 1 day per visit. Objective: Ensure ongoing compliance and address changes in scope, risks, or processes. Key Focus Areas: Maintenance of documented procedures and records. Resolution of previous non-conformities. Adaptation to new threats or regulatory changes (e.g., GDPR updates, emerging cyber threats). Outcome: Successful surveillance audits renew certification for another 3 years; failures may require corrective actions or decertification. Recertification Audit Conducted at the end of the 3-year cycle. Follows the same structure as Stage 2 but includes a full re-evaluation of the ISMS. Duration: 2–5 days. Sample Internal Audit Report Structure (ISO 19011-Aligned) Internal audits, conducted annually or bi-annually, assess the ISMS’s conformity with ISO/IEC 27001 and organizational policies. The report structure follows ISO 19011 guidelines, emphasizing objectivity, evidence-based findings, and actionable recommendations. Below is a standardized template for clarity and consistency. 1. Audit Overview Audit Title: [e.g., "Annual ISMS Internal Audit – Q3 2024"] Audit Scope: ISMS processes, controls, and risk management (e.g., "All locations, excluding third-party vendors"). Audit Criteria: ISO/IEC 27001:2022 clauses, organizational policies, and relevant regulations (e.g., GDPR, NIST). Audit Team: Lead auditor, technical experts, and cross-functional representatives. Audit Dates: [Start/End dates]. Methodology: Desk reviews, interviews, sampling of records, and control testing. 2. Audit Objectives Verify compliance with ISO/IEC 27001 requirements. Assess effectiveness of implemented controls (e.g., A.9 Access Control, A.12 Operational Security). Identify opportunities for improvement in risk management and incident response. Ensure documentation aligns with operational practices. 3. Findings and Observations Introduced as a critical section where each finding is documented with evidence, root cause, and impact. Findings are categorized by severity: Major Non-Conformities (Significant deviations requiring immediate correction). Minor Non-Conformities (Lesser deviations with defined timelines for resolution). Observations (Best practice recommendations or inefficiencies). Example Finding Format: Finding ID: [e.g., F-2024-03] Clause/Control: A.12.1.1 – Operational Procedures Description: The "Password Reset Procedure" lacks documented steps for escalation to IT when self-service options fail, leading to delays in access recovery. Evidence: Sample incident logs showing unresolved reset requests (3+ days). Absence of escalation workflow in the procedure document. Root Cause: Inadequate review of procedures during the last management review. Lack of cross-functional input from IT and HR during procedure updates. Impact: Increased risk of business disruption (e.g., employee downtime). Potential non-compliance with A.12.1.1 and A.16.1.5 (Incident Management). Recommended Corrective Action (CA): Update the Password Reset Procedure to include escalation steps and approval workflows within 30 days. Conduct training for helpdesk staff on the new process within 15 days. Responsible Party: IT Security Manager. Target Completion Date: [DD/MM/YYYY]. Verification Method: Re-audit of the procedure and follow-up training records. 4. Strengths and Good Practices Example: The "Annual Security Awareness Training" achieved a 98% completion rate, exceeding the 95% benchmark. The interactive modules effectively addressed phishing simulations, reducing reported incidents by 22% YoY. 5. Audit Conclusions Summary of compliance status (e.g., "85% of controls fully compliant; 15% require corrective actions"). High-level risks identified (e.g., "Three major findings related to incident response delays"). Overall effectiveness rating (e.g., "ISMS demonstrates strong governance but requires improvements in operational controls"). 6. Audit Trails and Records List of documents reviewed (e.g., policies, logs, training records). Interview summaries with key stakeholders. Sampling details (e.g., "Reviewed 50 of 200 access reviews for compliance"). Measuring ISO/IEC 27001 Effectiveness Through KPIs Quantifying the ISMS’s impact requires Key Performance Indicators (KPIs) that align with ISO/IEC 27001 objectives, such as risk reduction, control effectiveness, and resource optimization. KPIs should be SMART (Specific, Measurable, Achievable, Relevant, Time-bound) and benchmarked against industry standards or historical data. Core KPI Categories: 1. Risk Management ISO cybersecurity standards provide a comprehensive blueprint for organizations navigating the complexities of digital risk management. From foundational principles like the PDCA cycle to advanced technical controls such as encryption and SIEM integration, the framework ensures that security measures are both robust and adaptable. The interplay between ISO 27001’s risk assessment methodologies and operational controls—coupled with compliance mechanisms for GDPR, HIPAA, and PCI DSS—demonstrates how standardization can drive efficiency without compromising flexibility. By embracing continuous improvement through internal audits, KPIs, and management reviews, organizations not only achieve certification but also cultivate a culture of vigilance. Ultimately, the power of ISO cybersecurity lies in its ability to turn abstract threats into actionable strategies, securing digital assets while aligning with broader business objectives. System Critical Logs Use Case Firewalls Connection drops, port scans Detect brute-force attacks Databases SQL injection attempts, privilege changes Prevent data breaches Endpoints Process execution, registry changes Identify malware Cloud (AWS/Azure) API calls, IAM changes Cloud misconfigurations