- ✓The shared responsibility model defines which security tasks belong to the cloud provider and which belong to the customer: understanding this model is fundamental to avoiding security gaps in cloud deployments.
- ✓Identity and access management (IAM) is one of the most critical security controls in cloud environments: the principle of least privilege, granting users and services only the permissions they need, should be applied rigorously.
- ✓Data encryption at rest and in transit is a baseline security requirement for all cloud deployments, and organisations must understand and control how encryption keys are managed, including whether the provider or customer holds the keys.
- ✓Compliance in cloud environments requires demonstrating that specific regulatory requirements are met within the cloud architecture, and most major cloud providers offer compliance tools, audit logs and certification documentation to support this.
- ✓Cloud security posture management (CSPM) tools provide automated visibility into the security configuration of cloud environments, helping organisations detect misconfigurations that are among the most common sources of cloud security incidents.
Listen to the full episode inside the course. Enrol to access all 80 episodes, plus assignments, tutor support and Student Finance funding.
Start learning →Alex: Welcome back to The Study Podcast. We're closing out Unit 6 today with cloud security and compliance, which Sam, you've described as the area where cloud projects most commonly go wrong once they're in production.
Sam: It's certainly where many organisations underestimate the work involved. There's a common misconception that moving to a reputable cloud provider means your security and compliance concerns are handled. They're not. The cloud provider secures the infrastructure: the hardware, the networking, the physical facilities. But the customer is responsible for securing everything built on top of that infrastructure: the operating systems, the applications, the data, the access controls.
Alex: That's the shared responsibility model.
Sam: Exactly. And the specifics of where the boundary sits depend on which service model you're using. In IaaS, you're responsible for everything above the hypervisor. In PaaS, the provider manages more, but you're still responsible for your application and data. In SaaS, the provider manages almost everything, but you're still responsible for user access management and your data. Understanding where your responsibility begins and ends for each service you use is essential.
Alex: Let's talk about identity and access management, because this seems to be where a huge number of cloud security incidents originate.
Sam: IAM misconfiguration is one of the leading causes of cloud security incidents. The pattern is familiar: an organisation creates a user account or service account with broad permissions for convenience during development, forgets to restrict or rotate those permissions, and the account is eventually compromised and used for malicious purposes. The principle of least privilege, granting every user and service the minimum permissions needed to do their job and no more, should be applied rigorously from day one.
Alex: Encryption comes up a lot in cloud security discussions. What are the key considerations?
Sam: Two main dimensions. Encryption at rest protects data stored on disk from being read by anyone who gains physical access to the storage media. Encryption in transit protects data as it moves across networks. Both should be standard practice for any sensitive data in a cloud environment. The critical additional question is key management: who controls the encryption keys? If the cloud provider manages your keys, they theoretically have access to your data. Many organisations use customer-managed keys, or even hardware security modules, to retain control of their own keys.
Alex: And compliance in cloud environments. How do you demonstrate that you're meeting your regulatory obligations?
Sam: Cloud providers offer extensive tools to support compliance: compliance dashboards, pre-built policy sets for common frameworks like ISO 27001 and SOC 2, audit logging services that provide a complete trail of all access and activity, and certification documentation that demonstrates the provider has achieved specific standards. But the documentation produced by the cloud infrastructure is only part of the picture: you also need to demonstrate the security of your application layer and your data governance processes.
Alex: Excellent close to Unit 6. We'll start Unit 7 on software development lifecycles in our next lesson. Thanks, Sam.