Cloud Security Architecture & Hardening: Build It Secure, Keep It Secure

A two-part course separating designing a secure cloud from keeping it secure. Part one is architecture: trust boundaries and shared responsibility, identity as the real control plane, network segmentation, data protection and cryptography, and secure configuration baselines. Part two is operations: workloads, containers and serverless, application and API security, logging and detection, resilience and recovery, and a closing workshop. Identity is the center of gravity, anchored to real incidents — the 2024 Snowflake tenant breach and the Storm-0558 signing-key compromise — covering the two failure modes that matter most: credentials without strong authentication on a non-SSO path, and compromise of a trust anchor itself.

The course uses the CNAPP vocabulary vendors are selling now and breaks it into its actual parts: CSPM, CWPP and CIEM. It covers post-quantum cryptography migration for cloud key management, which very few cloud security courses have yet, and includes service mesh proxy architecture per NIST SP 800-233, CISA's SCuBA baselines, and FedRAMP's shift to the 20x authorization model. The closing workshop hands participants a fictional cloud architecture and asks for a prioritized, defended hardening plan.

What You Will Learn

• Define cloud security architecture, identify trust boundaries, and apply shared responsibility to real control ownership
• Distinguish human identities from workload and service identities, and apply least privilege across both
• Identify excessive permissions, stale identities and privilege escalation paths using entitlement management
• Design segmented cloud networks and apply Zero Trust principles per NIST SP 800-207 and 800-207A
• Protect data at rest, in transit and in processing, and manage the cryptographic key lifecycle
• Establish secure configuration baselines and detect drift from them
• Harden compute, containers and serverless workloads, and protect images and registries
• Secure applications and APIs, including service-to-service trust and secrets handling
• Build security logging and detection coverage across identity, network, workload and administrative activity
• Design for resilience and prepare for compromised identities, workloads and accounts
• Produce and defend a prioritized cloud-hardening plan

Course Outline

Module 1

• Draw the Boundary: Cloud Security Architecture Foundations
• Service and deployment models
• Security design principles
• Assets, resources and trust boundaries
• Shared responsibility
• Control ownership versus inherited capability
• Common attack surfaces
• Defense in depth
• CNAPP as the umbrella over CSPM, CWPP and CIEM

Module 2

• Identity Is the Control Plane: IAM Architecture
• Identities, roles, permissions and entitlements
• Human versus workload identity
• Least privilege
• Role-based and attribute-based access
• Privileged access and administrative separation
• Stronger authentication including legacy non-SSO paths
• Entitlement management
• Case studies on the 2024 Snowflake tenant breach and the Storm-0558 signing-key compromise

Module 3

• Trust No Network: Cloud Network Security Architecture
• Security zones and trust boundaries
• Virtual networks, subnets, routing and gateways
• Segmentation and microsegmentation
• Inbound and outbound control
• Security groups and filtering
• Protecting management interfaces
• Zero Trust per NIST SP 800-207 and 800-207A
• Service mesh proxy architecture per SP 800-233

Module 4

• Protect the Data: Cloud Data Security & Cryptography
• Classification
• Protection at rest, in transit and in processing per NIST IR 8505
• Encryption across storage, databases and applications
• Key lifecycle management
• Organization-managed versus provider-managed keys, BYOK and HYOK
• Secrets, tokens, certificates and API keys
• Minimization, retention and secure deletion
• Post-quantum cryptography migration
• FIPS 140-3 and SP 800-57 for federal environments

Module 5

• Harden the Foundation: Secure Cloud Configuration
• Baselines using NIST guidance, the CSA Cloud Controls Matrix and CIS Benchmarks
• Insecure defaults and unnecessary services
• Hardening management planes
• Restricting public exposure
• Least functionality
• Configuration drift detection
• Managing approved exceptions
• The FedRAMP 20x model for federal environments

Module 6

• Lock Down the Workload: Compute, Containers & Serverless
• Hardening instances and operating systems
• Protecting images, templates and deployment artifacts
• Container isolation and runtime security
• Protecting registries against malicious and typosquatted images
• Serverless security and emerging abuse patterns
• Reducing workload privilege
• The NIST SP 800-204 series for cloud-native architectures

Module 7

• Secure the Front Door: Applications, APIs & Services
• Application attack surfaces
• Application-to-application communication
• API authentication and authorization per NIST SP 800-228 Update 1
• Secure API gateways
• Service identity and service-to-service trust
• Protecting secrets without relying on environment variables
• Secure development per SP 800-218 and 800-218A

Module 8

• See Everything: Logging, Monitoring & Detection
• Identifying security-relevant logs and telemetry
• Enabling logging across identity, network, workload and administrative activity
• Centralization and retention
• Protecting logs from alteration
• Alerting on suspicious administrative activity
• Detecting drift
• Supporting investigation
• CISA SCuBA baselines as a mandated example

Module 9

• Assume Something Breaks: Resilience, Recovery & Incident Readiness
• Designing for availability
• Single points of failure and critical dependencies
• Redundancy and fault tolerance
• Protecting backups
• Recovery objectives and restoration priorities
• Preparing for compromised identities, workloads and accounts including a compromised trust anchor
• NIST SP 1800-35

Module 10

• Architect, Harden, Defend: Cloud Security Workshop
• Review a fictional architecture, identify trust boundaries and insecure exposure, evaluate identity and privileged access risk against a real recent breach, assess segmentation, data protection and key management including post-quantum timing, then build and defend a prioritized hardening plan