Cloud Security, Risk, and Compliance
Core model
Security work starts from confidentiality, integrity and availability, applied through the shared responsibility model. In IaaS the provider secures facilities, hardware and hypervisor; the customer secures the guest OS, patching, network rules, identities and data. As you move to PaaS and SaaS, more controls become inherited from the provider - but never identity, access design or data classification.
Controls candidates must recognise
Identity and access management with least privilege, role-based assignment, federation/SSO and mandatory MFA for privileged accounts. Encryption in transit (TLS) and at rest, with key management services or HSMs; know the difference between provider-managed and customer-managed keys, since compliance regimes may demand customer key custody or BYOK/HYOK. Network and application controls: security groups, web application firewalls, DDoS protection. Detection and response: audit logs (CloudTrail, Activity Log, Cloud Audit Logs), centralised SIEM, CSPM for misconfiguration, CASB for SaaS shadow IT, vulnerability scanning and patch cadence. Incident response phases: prepare, detect, contain, eradicate, recover, lessons learned.
Risk and compliance
Distinguish threat (who/what could cause harm), vulnerability (the weakness), and risk (likelihood × impact). Treat risk by mitigating, transferring, avoiding or accepting. Frameworks you will see named: SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP, GDPR, plus data residency/sovereignty rules.
Trap: "the provider is PCI DSS certified, so our workload is compliant." False - attestations cover the provider's layer only; your configuration, logging and access design must independently satisfy the standard. Similarly, encryption is a control, not a compliance certificate.
Worked example: a publicly readable object-storage bucket holds customer records. Threat = anonymous retrieval; vulnerability = no authentication plus no encryption; risk = high likelihood × high impact. Mitigation = block public access, enforce policy-as-code, enable default encryption, add alerting on policy changes, then accept the residual risk formally.