Cloud Security

1. Cloud models and the shared-responsibility boundary

Moving to the cloud does not move the responsibility for security; it redistributes it along a line that changes with the service you choose. This lesson defines cloud computing, compares the service and deployment models, and sets out the shared-responsibility model that determines who patches, configures and monitors each layer. It ends with the account structure that contains the blast radius of a mistake, and with the data-residency questions that a Ghanaian organisation must answer before it stores personal data abroad.

2. Identity and access management

In the cloud the identity is the perimeter. Every action is an API call made by a principal, and the question 'who can do what, to which resource, under which conditions' is answered by policies rather than by a locked door. This lesson covers principals, policies and the principle of least privilege, the difference between long-lived keys and temporary credentials, multi-factor authentication, and the audit tools that find over-privilege. The examples use AWS, with the equivalents on Azure and Google Cloud noted.

1. Network and workload protection

A cloud workload is only as exposed as its network rules allow. This lesson covers how to design a virtual network so that only the components that must face the internet do, how security groups and network access control lists differ and how to audit them, how to replace open administrative ports with managed access, and how to harden the containers and clusters that run modern applications. Each control is paired with a command that proves it is in place.

2. Data protection and secrets

Data is what attackers want, and it is also what regulators ask about. This lesson covers encryption at rest and in transit, the key-management decisions that determine who can read encrypted data, the storage of application secrets and their rotation, backups that resist ransomware through immutability, and the obligations that Ghana's Data Protection Act, 2012 places on anyone who processes personal data. The practicals encrypt, store, rotate and recover real objects in a lab account.

1. Cloud security posture and infrastructure as code

A cloud account is configured thousands of times a year, by people and by automation, and the configuration drifts. Cloud security posture management (CSPM) is the practice of continuously comparing the real configuration against a benchmark. Infrastructure as code (IaC) moves that comparison to before deployment, where a mistake costs a pull-request comment instead of a breach. This lesson covers both, with the benchmarks that define 'secure', the tools that check them, and the policy-as-code approach that keeps a team's standards in version control.

2. Cloud detection and incident response

In the cloud the control plane is the crime scene. Every creation, change and access is an API call recorded by the platform, and the same records that let an investigator reconstruct an attack let a detection system find it. This lesson covers the cloud audit trails and the managed threat detection services built on them, the common attack paths against cloud accounts, and the containment and eradication steps for a compromised identity, which differ from those for a compromised server. It ends the course with a complete response to a leaked credential.