4.2.4. Cloud Workload Protection
💡 First Principle: Cloud workload protection (CWP) goes beyond configuration checking (CSPM) to actively detect and help prevent real-time threats against running workloads — virtual machines, containers, databases, and storage — using capabilities like just-in-time VM access and adaptive application controls.
Just-in-time (JIT) VM access reduces the attack surface of management ports (like RDP/SSH) by keeping them closed by default and opening them only temporarily when explicitly requested and approved — a workload-level cousin of PIM's just-in-time philosophy (Phase 3.4.3). Adaptive application controls learn which applications normally run on a given VM and can alert on (or block) anything unexpected, catching malware or unauthorized software.
⚠️ Exam Trap: CSPM (4.2.2) finds misconfigurations before an attack happens; cloud workload protection defends against active threats to running resources. A question about detecting an in-progress attack is testing CWP, not CSPM.
Reflection Question: How does just-in-time VM access apply the same underlying principle as Privileged Identity Management (Phase 3.4.3), even though one protects a network port and the other protects an admin role?
