Cloud and Emerging Technology Security
Cloud and Emerging Technology Security
This domain tests how security changes when infrastructure is abstracted, elastic, and API-driven. Expect questions on the shared responsibility model, cloud service models, misconfiguration, identity in the cloud, CASB/CSPM/CWPP, containers, infrastructure as code, and emerging AI/API risks.
Core rules
- Shared responsibility varies by model. In IaaS the provider secures facilities and hardware; the customer secures OS, patching, identity, and data. In SaaS the provider does more, but the customer still owns data classification, access, and configuration.
- Misconfiguration is a leading cloud risk: public storage, overly broad IAM policies, exposed management interfaces, and disabled logging.
- Cloud identity is the control plane. Enforce least privilege, MFA, role assumption, and short-lived credentials; avoid long-lived access keys.
- CSPM finds configuration drift; CWPP protects workloads; CIEM analyzes identity entitlements; CASB governs SaaS use; SASE/SSE converges network and security services.
- Containers share the host kernel, so isolation and image scanning matter. Kubernetes requires RBAC, network policies, admission control, and secret management.
- Infrastructure as code should be scanned before deployment; secrets belong in a vault, not in repositories.
Worked example
A developer makes an object-storage bucket public to share files. CSPM flags it, but the data is already exposed. The reasoning: the provider secured the storage service, but the customer owned the bucket policy under shared responsibility. Fix by blocking public access at the account level, using signed URLs or a private CDN, scoping IAM, and enabling access logging. Detection without preventive guardrails leaves the same misconfiguration repeatable.
Traps
- Assuming the cloud provider secures customer data by default.
- Treating cloud workloads like static data centers; elasticity and APIs change the attack surface.
- Forgetting that AI systems add risks such as prompt injection, data leakage, and model supply chain.