MODULE 7: Cloud Security Fundamentals

Lesson 1: Shared Responsibility Model

1. What is the Shared Responsibility Model?

The cloud provider and the customer share security responsibilities.

Provider = Secures the Cloud

They are responsible for:

• Physical data centers
• Hardware
• Network infrastructure
• Hypervisors
• Power, cooling, building security

Customer = Secures What They Put in the Cloud

They are responsible for:

• User accounts
• Data
• Applications
• Configurations
• Access permissions
• Network rules

2. How Shared Responsibility Works in Different Cloud Types

IaaS (Infrastructure as a Service)

E.g.: Azure VM, AWS EC2
Customer manages:

• OS
• Applications
• Network ACLs
• Patches

Provider manages:

• Hardware
• Virtualization
• Storage

PaaS (Platform as a Service)

E.g.: Azure App Service, AWS Lambda
Customer manages:

• Application code
• Identity & access
• App configurations

Provider manages:

• OS
• Runtime
• Middleware

SaaS (Software as a Service)

E.g.: Office 365, Gmail, Salesforce
Customer manages:

• Data
• User access
• MFA policies

Provider manages:

• Everything else

Why Shared Responsibility Matters

Most cloud breaches happen because companies misconfigure:

• Buckets (S3)
• Databases
• Access control
• Firewalls
• Public IP exposure

Not because of the provider.

Lesson 2: Cloud Identity & Access (Azure AD, IAM, Roles)

1. Identity Is the New Perimeter

In cloud, identity = the most important security control.

Main tools:

• Azure Active Directory (Azure AD / Entra ID)
• AWS IAM
• Google Cloud IAM

2. Authentication in Cloud

Cloud identity supports:

• Passwords
• MFA
• Conditional Access
• OAuth
• SAML
• Single Sign-On (SSO)

3. Authorization in Cloud

Cloud uses RBAC (Role-Based Access Control).

Examples:

• Reader
• Contributor
• Owner
• Security Admin
• Storage Admin
• Network Contributor

4. Principle of Least Privilege in Cloud

Only grant the minimum permissions needed.

Example:
A developer should NOT have permission to delete production resources.

5. Conditional Access

Policies that enforce:

• MFA
• Device compliance
• Specific locations allowed
• App restrictions

Used heavily in enterprises.

Lesson 3: Cloud Network Security

Cloud networks require strong configurations to prevent exposure.

1. Virtual Networks

Examples:

• Azure VNet
• AWS VPC
• Google VPC

They function like on-premise networks.

2. Network Security Groups (NSGs) / Security Groups

They control traffic:

• Allowed IPs
• Allowed ports
• Allowed protocols

Example rule:
Allow 443 inbound
Block 3389 from public internet

3. Firewalls in the Cloud

Cloud providers offer:

• Azure Firewall
• AWS Network Firewall
• GCP Cloud Armor

Features:

• Traffic filtering
• Threat intelligence
• Application rules

4. Private Endpoints

Many resources (databases, storage) should NEVER be exposed to the internet.

Private endpoints allow:

• Internal access ONLY
• No public IP
• Increases security massively

5. VPNs & ExpressRoute / Direct Connect

VPN Gateway

Encrypts traffic between on-premise & cloud.

ExpressRoute / Direct Connect

Dedicated private line:

• Faster
• More secure
• No internet involved

Used by banks, universities, and big corporations.

Lesson 4: Data Encryption & Backups

1. Data Encryption at Rest

Data stored in cloud must be encrypted.

Using:

• AES-256
• Customer-managed keys
• Hardware security modules (HSM)

Cloud tools:

• Azure Key Vault
• AWS KMS
• Google KMS

2. Data Encryption in Transit

All communication must use:

• HTTPS
• TLS 1.2+
• Secure APIs

3. Backup & Recovery

Cloud supports:

• Automated backups
• Snapshot recovery
• Geo-redundant backup
• Disaster recovery (Azure Site Recovery)

Benefits:

• Protects against ransomware
• Protects against accidental deletion
• Protects against system failure

4. Data Loss Prevention (DLP)

Stops sensitive data from:

• Being leaked
• Uploaded to personal drives
• Sent through email

Tools:

• Microsoft Purview DLP
• Google DLP
• AWS Macie

Lesson 5: Cloud Monitoring & Alerts

Monitoring is essential because cloud environments are always exposed to the internet.

1. Cloud Security Logs

Cloud platforms log everything:

• Login attempts
• Resource changes
• Failed actions
• Network traffic
• Suspicious requests

Tools:

• Azure Monitor
• AWS CloudWatch
• GCP Cloud Logging

2. SIEM Integration

Cloud logs go to SIEM tools:

• Microsoft Sentinel
• Splunk
• Wazuh
• IBM QRadar

These systems:

• Detect attacks
• Alert security analysts
• Show user behavior anomalies
• Help during incident response

3. Common Cloud Alerts

• Login from unusual location
• Failed MFA attempts
• Public exposure of resources
• Sudden download of massive data
• New admin role assigned
• Unexpected VM creation
• Suspicious API activity

4. Threat Detection in Cloud

Cloud offers built-in AI-based detection:

• Azure Defender
• AWS GuardDuty
• Google Security Command Center

These detect:

• Malware
• Botnets
• Misconfigurations
• Privilege escalation
• Suspicious network traffic

Module 7 Summary

Students now understand:

• How the shared responsibility model works in IaaS, PaaS, SaaS
• How identity works in cloud (Azure AD, AWS IAM)
• How cloud networks are secured (firewalls, NSGs, private endpoints)
• Why encryption & backups are essential
• How monitoring tools detect cloud breaches

This module answers the question:
“How do we secure data, access, and systems in the cloud?”