Security, Compliance, and Identity Concepts
The three lenses
Security, compliance, and identity are related but distinct. Security protects assets (confidentiality, integrity, availability). Compliance demonstrates that controls meet external or internal requirements (regulations, standards, policies). Identity is the control plane that decides who or what can do something. The Zero Trust model ties them together: verify explicitly, use least privilege, and assume breach. Candidates should know the shared responsibility model - the cloud provider secures the physical layer, while data, identities, and access configurations remain the customer's job regardless of service model (IaaS, PaaS, SaaS).
Core vocabulary
Know the difference between authentication (proving who you are) and authorization (what you may do). Defense in depth layers controls: physical, identity, network, compute, application, data. Encryption protects data at rest and in transit; hashing verifies integrity. Governance defines policy; risk management prioritizes threats.
Traps to watch
- Confusing compliance with security: passing an audit does not mean you are secure.
- Assuming the cloud provider is responsible for your data classification.
- Mixing up authentication vs. authorization in scenario questions.
- Treating Zero Trust as a product rather than a strategy.
Rule of thumb
When a question asks "who is responsible for X?" in the cloud, ask: is X data, identity, or configuration? If yes, the customer owns it. If X is physical infrastructure or the hypervisor, the provider owns it.
Worked example
A company stores customer records in a SaaS CRM. Who classifies the data as PII? The customer - classification is a data-layer responsibility, even though the SaaS provider secures the platform.