Skip to main content

Security Management Services in Google Cloud, Azure, and AWS

Managing security across Google Cloud, Azure, and AWS can feel overwhelming, especially as businesses adopt multi‑cloud environments and face constantly evolving threats. Each cloud provider offers its own CSPM, CWP, SIEM, and threat‑detection tools—but knowing which service does what is essential for building a strong security foundation. This guide breaks down the core security services across all three major cloud platforms, helping you compare capabilities, understand their roles, and choose the right controls to strengthen your cloud security posture.



CSPM: For Compliance & Posture

CWP: For Vulnerability & Workload Protection 



Google Cloud Security Services: 

Google Cloud uses Security Command Center (SCC) as its unified security platform for CSPM, CWP, and threat detection and Google Chronicle for SIEM/SOAR


  • CSPM - Security Command Center (SCC): For Compliance & Posture

  • Security Health Analytics (SHA): Posture & Compliance Scanning

Misconfigurations, compliance violations, IAM risks, public bucket exposure


  • CWP - Security Command Center (SCC): For Vulnerability & Workload Protection

  • Container Threat Detection (CTD): Runtime Threat Detection for Containers

Malware in containers, suspicious processes, privilege escalation attempts


  • Container Analysis: Vulnerability Scanning for container images

CVEs in container images, outdated packages


  • Web Security Scanner: Vulnerability Scanning for Web Apps

Scans applications running on App Engine, GKE, and Compute Engine for common web vulnerabilities. XSS, insecure configurations, outdated libraries


  • VM Threat Detection (VTD): Runtime threat detection for VMs

Monitors Compute Engine VMs for signs of compromise or malicious activity using runtime signals and logs. Crypto-mining, rootkits, suspicious binaries


  • Threat Detection via Logs: Used by SOC

  • Event Threat Detection (ETD): Suspicious IAM activity, anomalous network traffic, malware indicators, data exfiltration


  • SIEM: Google Chronicle

Collects and analyzes security telemetry for threat detection and investigation.





Azure Security Services: 

Azure uses Microsoft Defender for Cloud as its unified security platform for CSPM, CWP, and threat detection, integrated with Microsoft Sentinel for SIEM/SOAR.


  • CSPM: For Compliance & Posture

  • Microsoft Defender for Cloud (formerly Azure Security Center): For CSPM and CWP

Provides security posture management across Azure, AWS, and GCP.

Portal: portal.azure.com > Search for "Defender for Cloud"

Alert Types (CSPM): Misconfigurations, compliance violations, insecure settings.


  • Azure Policy: Creates, assigns, and manages policies to enforce security configurations and compliance. Often integrated with Defender for Cloud.

Portal: portal.azure.com > Search for "Policy"

Alert Types: Policy non-compliance alerts.



  • CWP: For Vulnerability & Workload Protection

  • Microsoft Defender for Cloud (formerly Azure Security Center): For CSPM and CWP

Protects VMs, containers, and PaaS services with vulnerability scanning and runtime protection.

Portal: portal.azure.com > Search for "Defender for Cloud"

Alert Types (CWP): Vulnerabilities, malware detection, suspicious processes


  • Azure Defender (Endpoint/Identity/Office): For example, Defender for Endpoint / Servers / Identity/Office

Includes Defender for Endpoint, Servers, Identity, and Office for advanced threat protection across workloads and identities.

Portal: https://security.microsoft.com/ 

Alert Types: Endpoint compromise, identity-based attacks, phishing, ransomware indicators.


  • Threat Detection via Logs: 

  • Microsoft Defender for Cloud + Defender family: Threat Detection – Used by SOC

Monitors Azure resources and integrated services for malicious activity.
Alert Types: Suspicious sign-ins, anomalous network traffic, privilege escalation attempts.


  • SIEM: 

  • Microsoft Sentinel (SIEM/SOAR) (formerly Azure Security Center)

Cloud-native SIEM and SOAR platform for collecting, analyzing, and correlating security data across environments.

Portal: portal.azure.com > Search for "Microsoft Sentinel"

Alert Types: Threat detection alerts, automated incident response workflows.




AWS Security Services: 

AWS uses a combination of Security Hub and Config for CSPM, Amazon Inspector for CWP, and GuardDuty for threat detection, with Security Lake providing SIEM-like capabilities.


  • CSPM: For Compliance & Posture

  • AWS Security Hub: CSPM

Aggregates and prioritizes security findings across AWS services.

Alert Types: Aggregated findings from AWS services (WAS Config, AWS GuardDuty, AWS Inspector) and partner tools; compliance violations (CIS, PCI DSS, etc.).


  • AWS Config: CSPM

Tracks resource configurations and evaluates compliance over time.
Alert Types: Configuration drift, non-compliant resources, rule violations.



  • CWP: For Vulnerability & Workload Protection

  • Amazon Inspector: CWP (Vulnerability Management)

Automated vulnerability scanning for EC2, containers, and Lambda workloads.
Alert Types: Vulnerabilities (CVEs), exposed network paths, software misconfigurations.


  • Threat Detection via Logs: 

  • Amazon GuardDuty: Threat Detection – Used by SOC

Threat detection service monitoring AWS accounts and workloads for malicious activity.
Alert Types: Security Alerts - Suspicious API calls, compromised credentials, crypto-mining activity, anomalous network traffic.



  • SIEM-like capability for AWS: 

  • Amazon Security Lake (SIEM-like) + Lambda/EventBridge for SOAR

Centralized Security Data Lake, Collects and normalizes security logs from AWS services and third-party sources into a centralized data lake for analytics

Alert Types: Security Lake itself does not create alerts; it stores and normalizes logs (e.g., GuardDuty findings, Inspector vulnerabilities, VPC Flow Logs, CloudTrail events) for analysis by SIEM tools or custom queries.


  • Incident Investigation & Forensics: 

  • Amazon Detective: 

Investigates and analyzes security incidents using graph-based data.

Alert Types: Detective does not produce alerts; it consumes alerts from GuardDuty, Security Hub, and other sources and provides context for investigation (e.g., related resources, timelines, and behaviors) and root cause analysis.


  • Best-Practice Advisory tool:

  • AWS Trusted Advisor: Best-Practice Advisory tool 

Provides best-practice recommendations for cost, performance, and security.
Alert Types: Recommendations (not real-time alerts) for security gaps, cost optimization, performance improvements.


Comments

Post a Comment

Popular posts from this blog

Traffic journey from Client to Backend in Google Cloud

Securing cloud applications begins with understanding how request traffic moves through Google Cloud’s infrastructure. From the moment a request leaves the client machine to the moment it reaches backend services, every component along the path contributes to performance, resilience, and security. When I first explored this flow, I found myself overwhelmed by the number of services involved — and unsure which ones were essential, optional, or security‑critical. What happens at each hop? How do these services interact? And which layers truly matter when building a secure, compliant, and scalable cloud application in Google Cloud? This post breaks down those questions using a simple, intuitive analogy: an airport journey. In this model, the client request becomes a passenger navigating terminals, security checkpoints, and routing desks — eventually boarding the airplane (backend service) where your application runs. In the next post, I’ll flip the perspective and walk through the return ...
2 comments
Read more

Return Journey: From Backend to Client in Google Cloud

This post is the companion to the inbound journey (client → backend). While the forward path focuses on request security and routing, the return emphasizes response optimization, caching, and identity preservation — with most action still at the edge. The return path mirrors the forward journey, but now the response is making its way out of Google Cloud toward the client. Each milestone plays a specific role in ensuring the response is secure, optimized, and delivered efficiently — just like an aircraft preparing for departure, navigating airspace, and landing at its destination. TL;DR:  1. Backend → Service Mesh → API Gateway/Layer (Optional) + Identity Layer (Optional) The response is created, validated, transformed, and cleared for departure (aircraft at gate → ground crew → departure checkpoint → identity clearance desk). 2. Premium Backbone The response travels across Google’s private, optimized global network (private high‑speed air corridor). 3. Load Balancer Edge → GFE → GF...
Post a Comment
Read more

Cloud Security Foundations: Perimeter, Landing Zone, and Hub‑and‑Spoke Explained

Modern cloud architecture relies on a few foundational building blocks that determine how secure, scalable, and well‑organized your environment will be. Three of the most important concepts— Perimeter Security , Landing Zones , and Hub‑and‑Spoke architecture —often get mixed up or used interchangeably, even though each plays a very different role. Understanding how these pieces fit together is essential for designing a secure cloud environment that can handle real‑world workloads. This guide breaks down each concept in simple terms and uses a practical analogy to help you visualize how they work individually and as part of a unified cloud security strategy. 1. Perimeter Security in Cloud This refers to the outermost security boundary where external traffic first interacts with your cloud environment. In traditional networks, this was the firewall at the edge. In cloud, it’s often implemented using: Cloud-native firewalls (e.g., GCP Firewall Rules, AWS Security Groups/NACLs) Web Appli...
Post a Comment
Read more