Cloud security fundamentals

Why cloud security is a different game

Cloud security is not a new flavor of network security — it is a different model with different failure shapes. This lesson sets the frame for everything that follows.

The shared responsibility model in plain language

Every cloud provider publishes a "shared responsibility model" diagram. It is the most important thing they publish and the most often misread.

Identity is the new perimeter

In the cloud, the firewall is replaced by identity. If an attacker has a valid token with the right scope, the network controls do not save you. This is why identity hygiene now sits where firewall rules used to.

Network segmentation in cloud-native environments

Cloud networks behave differently from on-prem networks. The defaults are usually open within an account and closed to the public internet — the opposite of where most on-prem networks land. That cuts both ways.

Encryption — what is automatic and what isn't

Cloud providers will tell you encryption is on by default. They are technically correct. They will not tell you which threat model that default actually defends against.

Cloud-native logging and monitoring foundations

The good news about logging in the cloud: every API call, every console action, every resource change can be logged. The bad news: by default many of those logs are not retained, not centralized, and not parsed.

Misconfiguration is the most common breach vector

We have read or written the postmortems for hundreds of cloud breaches. The single most common root cause is not a sophisticated attack. It is a misconfiguration that lived in production long enough for someone to find it.

Container and serverless security basics

Containers and serverless functions are not magic. They have their own security profile, and their own classes of failure.

Building a cloud incident response playbook

An incident response plan you have not rehearsed is a plan you do not have. This lesson walks through the structure of a workable cloud incident response playbook.

Continuous compliance — drift, evidence, and audit

Compliance in the cloud is not a checklist you complete once a year. It is a continuous practice with three pillars: prevent drift, gather evidence automatically, and stay ready for audit.