Cloud and Emerging Technology Security
Domain 8 tests security in cloud service models and newer technology patterns. Expect shared responsibility, IaaS/PaaS/SaaS boundaries, identity as the control plane, misconfiguration, cloud security posture management, CASB, containers, infrastructure as code, secrets management, and emerging AI risks.
Core rules
- Shared responsibility varies by model. The provider secures the cloud infrastructure; the customer secures what it puts in the cloud, such as identities, data, configurations, and workloads. SaaS shifts more to the provider but does not remove customer duties for access and data handling.
- Identity and permission design are primary controls. Avoid long-lived keys, wildcard permissions, and public exposure by default.
- Misconfiguration is a leading cloud risk. Use policy as code, CSPM, logging, and guardrails rather than relying on manual review.
- Container images need scanning, minimal base images, and registry controls. Infrastructure as code must be reviewed and scanned before deployment.
- Secrets belong in a managed secrets store, not source code or images.
Worked example
A storage bucket is found publicly readable. The response is to remove public access, identify what was exposed, rotate any credentials in the objects, enable access logging and alerts, and add an organization policy that blocks public bucket creation unless explicitly approved. The reasoning is to contain exposure, assess impact, and prevent recurrence through preventive and detective controls.
Traps
Do not assume the provider secures customer data and configurations. Do not treat cloud defaults as secure defaults. Do not place secrets in code, images, or tickets.