What you'll learn
- Shared responsibility
- Common misconfigurations
- Cloud security tooling
- Kubernetes and containers
Lessons
1Shared responsibility
The provider secures the cloud; you secure what you put in it. In IaaS you own OS patching, network rules and data; in SaaS you still own identities, data classification and configuration.
2Common misconfigurations
- Public storage buckets/blobs.
- Management ports (22/3389) open to 0.0.0.0/0.
- Over-privileged service principals and long-lived access keys.
- Secrets in environment variables or code (see the Zeabur incident, Oct 2026).
- Logging disabled (CloudTrail, Azure Activity Log, Defender plans).
3Cloud security tooling
CSPM scores configuration against benchmarks (CIS, MCSB). CWPP protects VMs, containers and serverless. CIEM right-sizes permissions. CNAPP bundles these. Azure: Defender for Cloud, Policy, Sentinel. AWS: Security Hub, GuardDuty, Config. GCP: Security Command Center.
4Kubernetes and containers
Scan images, run as non-root, set resource limits, use network policies, enable RBAC and audit logs, and keep the API server private. Pod Security Standards ("restricted") block risky settings.
Hands-on lab: Run a CSPM baseline on your own subscription
- In an Azure test subscription, open Defender for Cloud → Recommendations.
- Filter to High severity and export the list.
- Fix one: restrict an NSG rule allowing RDP from the internet.
- Assign the built-in policy 'Storage accounts should restrict network access'.
- Re-check secure score after 24 hours.
Outcome: A measurable before/after secure score.
Practice questions
In SaaS, who manages user identities and data classification?
Answer: Customer. Identity and data stay customer responsibilities.
CSPM primarily finds…
Answer: Configuration drift and misconfigurations. Posture management checks configuration.
Safest way to give an app access to cloud resources?
Answer: Managed identity / workload identity. No secrets to leak; tokens rotate automatically.
The full graded assessment (5 questions, pass mark 70%) is in the platform.
Key terms
- Split of security duties between cloud provider and customer.
- CSPM
- Cloud Security Posture Management: detects misconfigurations against benchmarks.
- CWPP
- Cloud Workload Protection Platform: protects VMs, containers and serverless.
- CIEM
- Cloud Infrastructure Entitlement Management: right-sizes cloud permissions.
- CNAPP
- Cloud-Native Application Protection Platform combining CSPM, CWPP, CIEM and more.
- Managed identity
- Cloud-provided identity for workloads, removing the need for stored secrets.
- Private endpoint
- Private IP access to a cloud service, keeping traffic off the public internet.
- IMDS
- Instance Metadata Service; a common SSRF target. Use IMDSv2 on AWS.
- Pod Security Standards
- Kubernetes policy levels: Privileged, Baseline, Restricted.
See the full cyber security glossary →
Official references
Related courses
Network Security
Protocols, segmentation, firewalls, IDS/IPS and how to read traffic like an analyst.
Identity & Access Management
Authentication, MFA, SSO, privileged access and the identity attacks defenders see most.
Cryptography & PKI
Symmetric vs asymmetric crypto, hashing, TLS, certificates and the move to post-quantum.