Cloud Security Fundamentals

Cloud security addresses the unique challenges of protecting data, applications, and infrastructure in cloud environments. The Shared Responsibility Model defines security obligations:

Cloud Provider: physical security, hypervisor, network infrastructure
Customer: data, applications, OS configuration, IAM, network controls

The split varies by service type: IaaS (more customer), PaaS (shared), SaaS (more provider).

Cloud Security Threats

Misconfiguration — #1 cloud breach cause (open S3 buckets, overly permissive IAM)
Insecure APIs — most cloud interaction is via APIs; poorly secured APIs are major targets
Account Hijacking — compromised cloud credentials give attackers full resource access
Insider Threats — employees with console access can exfiltrate data easily
Supply Chain Attacks — compromised dependencies in cloud-native apps

Cloud Security Tools & Services

Tool Type	Purpose	Examples
CSPM	Cloud Security Posture Management — detect misconfigurations	Prisma Cloud, Wiz, AWS Security Hub
CWPP	Cloud Workload Protection — protect VMs, containers	CrowdStrike, Sysdig
CASB	Cloud Access Security Broker — visibility/control between users and cloud apps	Netskope, Zscaler
SIEM	Log aggregation from cloud services	Splunk, Microsoft Sentinel

AWS Security Essentials

IAM: fine-grained access control; use roles, not access keys
AWS GuardDuty: threat detection using ML
AWS CloudTrail: API activity logging for audit
AWS Config: resource configuration compliance
VPC Security Groups: instance-level firewall

☁️ Golden Rule: In the cloud, every misconfiguration is a public breach waiting to happen. Automate compliance checks with CSPM tools and enable all native logging services.