A TPM may not configure every firewall rule, rotate every encryption key, or conduct every penetration test — but we should understand the security concepts well enough to ask the right questions, identify risk, establish ownership, and make sure security is built into the program from the beginning.
For TPMs leading cloud, infrastructure, platform, software, or AI programs, I believe there are several foundational areas we should be comfortable discussing:
Shared Responsibility
Define clear ownership boundaries between the cloud provider, your organization, and third-party vendors. Ambiguity around who owns what can become a security risk by itself.
TLS 1.3 + HTTPS
Understand how modern encryption protects data in transit. TLS 1.3 improves security, removes weaker legacy cryptography, supports forward secrecy, and reduces handshake overhead.
Role-Based Access Control (RBAC)
Give people the permissions required for their role — and no more. Least privilege becomes increasingly important as teams, systems, APIs, and environments grow.
Privileged Access
Understand controls such as Privileged Identity Management (PIM), Multi-Factor Authentication (MFA), approval-based elevation, and recurring access reviews for sensitive administrative privileges.
Network & Platform Hardening
TPMs should understand concepts such as Network Security Groups (NSGs), private endpoints, secure routing, patching, endpoint protection, encryption, storage controls, and avoiding unnecessary public exposure.
Threat Modeling & Compliance
STRIDE provides a structured way to think about Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. TPMs should also understand the purpose of frameworks and requirements such as NIST, PCI DSS, SOC 1, SOC 2, FedRAMP, and GDPR.
One of the biggest lessons from leading large technical and security programs:
They need an owner, scope, acceptance criteria, dependencies, milestones, evidence, and a definition of done.
Security discovered at the end of a program becomes a blocker. Security designed into the program becomes part of the architecture. And compliance alone does not automatically mean a system is secure.
What cloud-security concept should every TPM understand?
Join the conversation on the original post — or subscribe on Substack for more on Technical Program Management, AI/ML, cloud infrastructure, security, and program execution.