Cloud and Application Security
Domain 8 covers cloud shared responsibility and application security. Know IaaS, PaaS, and SaaS boundaries, secure SDLC, OWASP Top 10 risks, secrets management, and cloud posture tools.
Core rules and concepts
- Shared responsibility: the provider secures the cloud infrastructure; the customer secures identities, data, configurations, and, in IaaS, the guest OS.
- IaaS gives most customer control; SaaS gives least. Responsibility shifts, but accountability for data usually stays with the customer.
- Secure SDLC includes threat modeling, secure coding, SAST, DAST, dependency scanning, and security testing in CI/CD.
- OWASP Top 10 includes broken access control, injection, insecure design, and security misconfiguration. Validate input, encode output, and enforce server-side authorization.
- Never hard-code secrets; use a secrets manager and rotate credentials.
- CSPM finds misconfigured cloud resources; CASB helps govern SaaS use.
Worked example
A company buys SaaS CRM. The provider patches the CRM application and runs its data centers. The customer must configure SSO and MFA, assign least-privilege roles, classify customer data, set retention, and monitor anomalous exports. Reasoning: buying SaaS does not outsource identity governance or data handling. A misconfigured public sharing setting is the customer's responsibility.
Traps that cost marks
'Cloud provider secures everything' is false. Moving to cloud does not automatically remove patching duties. SAST alone misses runtime authorization flaws. Storing API keys in source code is a breach waiting to happen.