Cloud Security.

Cloud security covers the practices used to secure workloads running on infrastructure that an organization does not fully own — typically AWS, Azure, GCP, or SaaS platforms. It spans identity and access management, network segmentation, encryption of data in transit and at rest, configuration hardening, workload protection, and continuous monitoring of cloud APIs and audit logs. Because the cloud is API-driven and elastic, traditional perimeter defences are insufficient; controls must follow the workload and integrate with the provider's native services (IAM, KMS, CloudTrail, Security Hub, Defender for Cloud).

The dividing line of accountability is the shared responsibility model: the provider secures the cloud (physical facilities, hypervisor, managed-service backplane) while the customer secures what runs in it (data, IAM policies, OS patching, and — crucially — configuration). Most publicized breaches trace to the customer's side. The 2019 Capital One breach is the canonical example: a misconfigured ModSecurity WAF was abused via server-side request forgery (SSRF) to reach the EC2 instance metadata service at 169.254.169.254, retrieving the temporary IAM credentials of an over-privileged role that could list and read S3 buckets — exposing roughly 106 million applicant records. It drove wide adoption of IMDSv2 (session-token-bound metadata requests), least-privilege IAM, and egress filtering. The 2023 Storm-0558 intrusion, in which a stolen Microsoft signing key let attackers forge tokens for Exchange Online, showed that even provider-side failures can cascade. Mature programs combine CSPM, CWPP, CIEM, and CNAPP tooling with CIS Benchmarks, guardrails as code, and strong governance under the shared responsibility model.

flowchart TD
  subgraph P[Provider secures the cloud]
    P1[Physical data centers]
    P2[Hypervisor / host]
    P3[Managed service backplane]
  end
  subgraph C[Customer secures in the cloud]
    C1[Data & encryption keys]
    C2[IAM policies & least privilege]
    C3[Configuration / hardening]
    C4[OS & app patching]
  end
  C3 -->|misconfig| M[SSRF -> IMDS creds<br/>e.g. Capital One 2019]
  M --> B[Data exfiltration]
  C2 -->|least privilege + IMDSv2| D[Blast radius contained]