Cybersecurity
Cloud security
Moving to a cloud provider changes who patches the hypervisor and nothing about who leaves a storage bucket readable by the whole internet. Cloud security is the customer's half of the shared responsibility model: identity policies, network rules, encryption settings and the constant checking that configuration still matches intent. The platforms themselves belong to the cloud field; this topic is about defending what you build on them.
Why this topic exists: Shared responsibility, cloud identity and posture management are tested in every cloud exam (SAA-C03 Design Secure Architectures, 30 %) and in SC-900; the cloud silo owns the platforms, this topic owns the defence.
Where the provider's job ends
Every major provider publishes a version of the same division of labour. AWS describes its own part as protecting the cloud itself, meaning the facilities, hardware, networking and software underneath its services, and leaves the customer answerable for everything placed on top. The line is not fixed. It moves with the kind of service chosen, and cloud security as a discipline is largely the craft of knowing where it sits for each workload and staffing the customer's side properly.
| Layer | Rented virtual machine | Managed storage or database service |
|---|---|---|
| Buildings, hardware, virtualisation | Provider | Provider |
| Guest operating system and its patches | Customer | Provider |
| Network rules around the resource | Customer, through security groups and similar | Customer, through access policies and endpoints |
| Data, its encryption settings and keys | Customer | Customer |
| Who may do what | Customer | Customer |
Read down the right-hand column and the pattern is plain: the more managed the service, the less there is to patch and the more of the remaining risk lives in configuration and permissions. That is why identity and access management carries such weight here. A policy that grants one role too much can expose more than an unpatched server, and cloud architectures are where zero trust, judging every request on its own merits instead of trusting a network location, tends to be put into practice first. AWS also names three shared controls in which each side acts within its own domain: patching, configuration management, and staff awareness and training.
- Identity: roles, policies and federation, reviewed as carefully as any firewall. The identity and access topic covers the discipline in full.
- Data protection: encryption at rest and in transit, plus a decision about who holds the keys and how often they rotate.
- Storage exposure: object storage buckets opened to the public by accident remain the signature cloud breach.
- Network paths: which resources face the internet at all, a design question the cloud networking topic treats from the builder's side.
- Posture checking: continuous comparison of live configuration against intended policy, because settings drift whenever people change them by hand, and a check that runs once a year finds only last year's mistakes.
Defaults are not a security decision
Newcomers often assume a provider's default settings are safe ones. Defaults are chosen so that things work on the first attempt, which is a different goal. The SAA-C03 blueprint gives designing secure architectures its largest domain, 30 per cent of scored content, and tests exactly these choices: access across several accounts, public and private subnets, encryption keys and their rotation, certificate renewal. Microsoft's SC-900 is the gentler entry, a fundamentals paper on security, compliance and identity concepts, while Cloud+ adds a vendor-neutral view with a security domain of its own. For the platforms themselves and the governance that keeps an estate orderly, continue in the cloud field and its governance and landing zones topic.
Next to this topic
- Security fundamentalsEvery blueprint opens here: the CIA triad, control types and the threat, vulnerability and risk vocabulary (SY0-701 General Security Concepts, 12 %; CISSP domain 1).
- Network securityFirewalls, segmentation, IDS/IPS, VPNs and zero trust are where most defensive work starts (CISSP Communication and Network Security, 13 %; Network+ and CCNA security domains).
- Identity and access managementWho may do what is its own discipline with its own exam (SC-300) and a full CISSP domain (13 %): authentication, MFA, SSO, directories and least privilege.
- CryptographyEncryption, hashing, keys and PKI underlie every other topic; the exams test them as applied choices, not maths (CISSP Security Architecture and Engineering; SY0-701 domain 1).
- Threats and attacksThe second-largest Security+ domain (Threats, Vulnerabilities and Mitigations, 22 %; only Security Operations weighs more): malware, phishing, social engineering, ransomware and the attack techniques defenders must recognise.
- Security operationsMonitoring, detection and the SOC are the largest Security+ domain (28 %) and the whole of SC-200 and CySA+: SIEM, logging, alert triage, threat hunting.
- Penetration testing and ethical hackingAuthorised attack as a profession: scoping, reconnaissance, exploitation, reporting (PTES; PenTest+ and CEH). Also the most-searched security topic on the course side.
- Governance, risk and compliancePolicies, risk assessment, frameworks (NIST CSF, ISO 27001) and audit are the management half of the field: CISSP domain 1 (16 %), CISM, CISA, Security+ Program Management (20 %).
- Application securityA large share of breaches begins in software: secure design, secure build, security testing and the OWASP Top 10 (OWASP SAMM; CISSP Software Development Security, 10 %).
- Security awareness for everyoneMost incidents start with a person, not a port: what every employee and freelancer must know about phishing, passwords, MFA, backups and updates (NICE Oversight and Governance; the management side of every blueprint).
Concepts to know
Glossary entries with the reason each one matters here.
- IAM
In the cloud, identity is the perimeter.
- Zero Trust
Cloud architectures are where zero trust is applied first.
- Object Storage
Misconfigured buckets are the cloud's signature breach.
- Encryption
At rest and in transit, with keys the customer controls.
Certifications that test it
Vendor exams and free certificates; facts, cost and the preparation path are on each page, and the certifications hub has them all.
- Microsoft · SC-900Microsoft Certified: Security, Compliance, and Identity FundamentalsMicrosoft's security, compliance and identity fundamentals.
- AWS · SAA-C03AWS Certified Solutions Architect – AssociateDesigning secure architectures is its largest domain.
- CompTIA · CV0-004CompTIA Cloud+Vendor-neutral cloud with a security domain.
Frequently asked
- Is cloud security harder than on-premises security?
- Different rather than harder. You give up control of the physical layer and gain an API that can report every setting in the estate, something that would take weeks to audit in a traditional data centre. The risk moves away from unpatched servers and towards permissions and configuration changed quickly by many hands.
- Who is responsible when a public bucket leaks data?
- The customer, in almost every case. The provider supplies a storage service that can be kept private; opening it, or failing to notice that someone else did, falls on the customer's side of the line.
- Should I learn a cloud platform or security first?
- Enough of each to read the other. A defender who is lost in a cloud console will miss what matters, and a cloud engineer without security vocabulary builds the gaps in. Many people start from one platform's fundamentals and add Security+ or SC-900 on top.
Courses in the directory
43 courses are filed here; the top 6 by our ranking, details and the provider link on each course page.
Last reviewed 26 September 2026 · Getting Digital