Reading List & People to Follow

The 6 ways CSOH members consume cloud security content

Each medium covers a different gap in your learning. Click a tile to jump to its picks.

Books

Grouped by topic. None of these are required reading; pick the one that maps to whatever you're working on this quarter.

Each book title links to its Open Library entry — pick up the cover, ISBN, and your preferred bookseller from there.

Cloud security foundations

• Practical Cloud Security — Chris Dotson. The closest thing to a textbook for the field. Provider-agnostic, control-focused. Read this first.
• Cloud Security Handbook — Eyal Estrin. More recent, more vendor-specific, useful as a complement.
• Hands-On AWS Penetration Testing with Kali Linux — Karl Gilbert & Benjamin Caudill. Dated in spots but the AWS attack patterns it walks through are still the right ones to learn.

Identity & IAM

• Solving Identity Management in Modern Applications — Yvonne Wilson & Abhishek Hingnikar. Best plain-English treatment of OIDC / OAuth / SAML in a single book.

Containers & Kubernetes

• Container Security — Liz Rice (lizrice.com). The standard reference. Short, dense, accurate.
• Hacking Kubernetes — Andrew Martin & Michael Hausenblas. The offensive companion to the above.
• Cloud Native Security — Chris Binnie & Rory McCune. Broader runtime + supply-chain coverage.

AppSec & DevSecOps

• Alice and Bob Learn Application Security — Tanya Janca (shehackspurple.ca). The most beginner-friendly AppSec book in print.
• Web Application Security — Andrew Hoffman. More advanced, more in-depth on attack surfaces.
• Securing DevOps — Julien Vehent. Older but the patterns hold up; Mozilla-flavored real-world examples.

Detection & incident response

• Applied Incident Response — Steve Anson. Practical, not theoretical. The book most DFIR people recommend to people newly responsible for IR.
• Practical Threat Intelligence and Data-Driven Threat Hunting — Valentina Costa-Gazcón. Pairs well with the SANS DFIR track.
• The Tao of Network Security Monitoring — Richard Bejtlich. Pre-cloud and unapologetically so, but the mental model is foundational.

Risk, leadership, and the meta-game

• How to Measure Anything in Cybersecurity Risk — Douglas Hubbard & Richard Seiersen. The book that retired the heatmap.
• The Manager's Path — Camille Fournier. Not security-specific, but the reference for any IC moving into management.
• Sandworm — Andy Greenberg. Long-form context on what nation-state attackers actually do; useful for anyone whose threat model includes them.
• Click Here to Kill Everybody — Bruce Schneier. Strategic-altitude view of the broader security landscape.

Newsletters

If you read three things a week, make these three things. All free, all email-based. Each card links to the subscribe page; the GitHub Actions workflow generates the preview screenshots after merge.

Blogs

Vendor research blogs (the good ones)

Not all vendor blogs are created equal. These earn their place because they publish original research, not product marketing.

Individual blogs worth a feed slot

Podcasts

People to follow on X / Bluesky / LinkedIn

A short, opinionated list of practitioners who consistently publish things worth reading. Many of these folks post the same content on multiple platforms; we note where they're most active. Search the name on the platform — the well-known ones surface immediately. PRs welcome to add or update.

Cloud security depth

• Scott Piper — Wiz; creator of the flAWS CTF series and the AWS Security Reference. Blog: Summit Route. Why follow: deep, no-fluff AWS security analysis. Active on: X, LinkedIn.
• Daniel Grzelak — CEO of Plerion; ex-Atlassian CISO. Why follow: opinionated cloud security commentary; will tell you when the emperor has no clothes. Active on: X, LinkedIn.
• Marco Lancini — runs the Cloud Security Newsletter. Blog: marcolancini.it. Why follow: technical clarity, generous link-sharing. Active on: X, LinkedIn.
• Rami McCarthy — Wiz; ex-Datadog. Why follow: balanced takes on tooling and program design; CSA Top Threats co-author. Active on: X, LinkedIn, Bluesky.
• Aidan Steele — independent. Blog: awsteele.com. Why follow: AWS deep-dives that often surface things AWS would prefer you didn't find. Active on: X.
• Houston Hopkins — IAM and guardrails at scale; well-known for AWS-Org-shaped war stories. Why follow: hard-won lessons about doing cloud security at large companies. Active on: X, LinkedIn.
• Will Bengtson — HashiCorp; ex-Netflix. Why follow: cloud detection & IR at scale; the Trailblazer / SecurityMonkey lineage. Active on: X, LinkedIn.

Detection, IR & offense

• Christophe Tafani-Dereeper — Datadog; maintainer of Stratus Red Team. Why follow: cloud attack-emulation thinking made approachable. Active on: X, Bluesky, LinkedIn.
• Andrew Krug — Datadog; long-time conference circuit. Why follow: practical IR + community-builder energy. Active on: X, LinkedIn.
• Rhino Security Labs — the Pacu / CloudGoat team. Why follow: announcements and write-ups for the canonical AWS-attack tooling. Active on: X, LinkedIn.

AppSec & DevSecOps

• Tanya Janca (SheHacksPurple) — AppSec educator at shehackspurple.ca. Why follow: kindest practitioner in security; great if you're new. Active on: LinkedIn, X, Bluesky.
• Clint Gibler — runs tl;dr sec. Why follow: sharp distillations of weekly research. Active on: X, LinkedIn.
• Liz Rice — Isovalent / CNCF; container security author. Personal site: lizrice.com. Why follow: definitive voice on Kubernetes and eBPF security. Active on: X, LinkedIn, Bluesky.

Strategy, leadership, broader security

• Phil Venables — Google Cloud CISO. Blog: philvenables.com. Why follow: board-level security thinking, well-written essays. Active on: X, LinkedIn.
• Kelly Shortridge — Fastly. Blog: kellyshortridge.com. Why follow: resilience engineering for security; will change how you think about programs. Active on: X, Bluesky.
• Rich Mogull — Securosis / FireMon. Why follow: has been doing cloud security since before the term existed. Active on: X, LinkedIn.
• Bruce Schneier — Harvard Kennedy School. Site: schneier.com. Why follow: the dean of security commentary.
• Bob Lord — ex-CISA, ex-DNC CSO. Why follow: cyber policy with operator credibility. Active on: LinkedIn, Bluesky, X.

Cloud journalism worth following

• Lily Hay Newman — WIRED. Why follow: cybersecurity reporting with technical fidelity.
• Catalin Cimpanu — Risky Business News. Why follow: volume + accuracy that's hard to beat.
• Andy Greenberg — WIRED; author of Sandworm. Why follow: long-form on nation-state and supply-chain security.

Papers, frameworks & canonical reads

The handful of documents you'll keep returning to. All free.

• CSA Security Guidance v5 — Cloud Security Alliance. The single best vendor-neutral primer for the field. ~250 pages, free PDF.
• MITRE ATT&CK for Cloud — The shared vocabulary for cloud attacker techniques. Map your detections against it.
• NIST SP 800-207: Zero Trust Architecture — The reference document everyone cites for zero-trust. Read the paper, not the marketing.
• CISA advisories — Current attacker activity and remediation guidance, US-government flavored.
• OWASP Top 10 for LLM Applications — The starting point for AI / LLM security threat-modeling.
• AWS Well-Architected Security Pillar — Free, opinionated, written by people who actually run AWS.
• Microsoft Cloud Adoption Framework — Secure — Azure equivalent.
• Google Cloud Architecture Framework — Security — GCP equivalent.
• Real breach post-mortems — see our breach kill chains for the curated set, each mapped to ATT&CK.

Contribute or correct

This list is intentionally short and intentionally opinionated. It will go stale unless the community keeps it honest:

• Add a person, blog, or book — open a PR against this page on GitHub. Include a one-line "why follow / why read." Self-nominations welcome (we'll review).
• Correct a handle, link, or affiliation — same path. Or message in the Signal chat.
• Suggest a removal — if a once-recommended resource has gone quiet or off-topic, flag it and we'll move it out of the active list.
• Suggest a new section — if you think a category is missing (e.g., "Cloud security YouTube channels"), file an issue.