# Cloud Security Fundamentals

> Chapter 13 of the Courseiva CISCO-CCNP-SECURITY curriculum — https://courseiva.com/learn/cisco-ccnp-security/cloud-security-fundamentals

**Official objective:** 4.1 — Describe cloud security concepts and shared responsibility model

## Introduction

Exam domain 4.1 asks you to describe cloud security concepts and the shared responsibility model. This concept solves the most fundamental confusion in cloud computing: who is actually accountable for securing what? If you work through this chapter, you will understand precisely where your job as a security professional starts and stops when your company moves to the cloud, which is a guaranteed topic on the 350-701 exam.

## The Apartment Building Analogy

A secure apartment building is a system of shared responsibility between the landlord and the tenants. The landlord owns the building's foundation, the exterior walls, the main water pipes, and the electrical wiring that runs through the core of the building. The landlord is responsible for ensuring the front door has a strong lock, the fire alarms work, and the roofing does not leak. No single tenant can change these core structures. 

 Each tenant, however, is solely responsible for their own flat. The tenant chooses the deadbolt on their front door. The tenant decides whether to lock their windows before leaving for work. The tenant manages who gets a spare key to their mailbox and whether they leave their laptop visible from the street when the blinds are open. If the tenant's flat gets burgled because they left a window open, the landlord does not accept liability, even though the landlord is responsible for the security camera in the lobby. 

 This precise split of duties maps directly to cloud security. The cloud provider (like the landlord) secures the underlying infrastructure — the physical data centres, the network cables, and the hypervisor — while the customer (like the tenant) secures everything they put inside the cloud: their data, their user accounts, their application configurations. A tenant cannot blame the landlord for a stolen laptop any more than a cloud customer can blame the provider for a misconfigured database that leaked customer records. Understanding exactly where your responsibility ends and the provider's begins is the entire foundation of cloud security.

## Core explanation

Cloud computing is a way of delivering IT services over the internet. Instead of a company buying its own physical servers, networking cables, and hard drives, it rents those resources from a cloud provider like Amazon Web Services (AWS), Microsoft Azure, or Google Cloud. This model is far cheaper and more flexible because you only pay for what you use, and you can scale up or down instantly. 

 A fundamental concept you must understand for the 350-701 exam is the shared responsibility model. This model defines who is responsible for securing each part of the cloud stack. The cloud provider is responsible for the security of the cloud, meaning the physical infrastructure, the network, and the hypervisor that virtualises the hardware. The customer is responsible for security in the cloud, meaning everything they create, configure, or store inside that infrastructure. 

 The exact split of responsibility changes depending on the service model you choose. There are three main service models you need to know for the exam: 

 - Infrastructure as a Service (IaaS): You rent virtual machines, storage, and networks. The provider secures the physical data centre and the hypervisor. You are responsible for securing the operating system, the applications, the data, and your network configurations like firewalls and access control lists. 

 - Platform as a Service (PaaS): You deploy your applications onto a platform the provider manages. The provider secures the runtime environment, the operating system, and the underlying hardware. You are responsible for your application code, the data you put into the platform, and the way you configure access to that data. 

 - Software as a Service (SaaS): You use a fully built application like Microsoft 365 or Salesforce. The provider handles nearly everything: the application, the runtime, the operating system, and the hardware. You are only responsible for your user accounts, the data you upload, and how you configure the application's security settings like multi-factor authentication. 

 Another critical concept is the cloud deployment model. The exam tests three main types: 

 - Public cloud: The provider makes resources available to anyone over the internet. Multiple customers share the same physical infrastructure, though their data is logically isolated. 

 - Private cloud: The infrastructure is used exclusively by one organisation. It can be hosted on-premises or by a third party, but the hardware is not shared with other customers. 

 - Hybrid cloud: A combination of public and private cloud that allows data and applications to be shared between them. This is common for organisations that need to keep sensitive data on-premises while taking advantage of the public cloud for less sensitive workloads. 

 There are five essential characteristics of cloud computing defined by the National Institute of Standards and Technology (NIST). You will see these tested on the exam: 

 - On-demand self-service: Users can provision resources without human interaction with the provider. 

 - Broad network access: Resources are available over the network and accessed through standard protocols. 

 - Resource pooling: The provider's computing resources are pooled to serve multiple customers using a multi-tenant model. 

 - Rapid elasticity: Resources can be scaled up and down quickly, often automatically. 

 - Measured service: Resource usage is monitored, controlled, and reported, providing transparency for both provider and customer. 

 Identity and access management (IAM) is a core security function that always falls on the customer's side of the shared responsibility model. The provider gives you tools like IAM roles and policies, but you must configure them correctly. For example, you must define who can create new virtual machines, who can read data from a storage bucket, and who can delete resources. If you misconfigure an IAM policy, you can accidentally expose sensitive data to the entire internet. 

 Encryption is another key topic. The provider typically offers encryption at rest (protecting stored data) and encryption in transit (protecting data as it moves across the network). However, the customer must enable these features and manage the encryption keys. Some providers offer a service called a key management service (KMS) to handle this, but you still control who accesses the keys. 

 Finally, you must understand the concept of multi-region architecture. Cloud providers have data centres in different geographic regions (e.g., US East, Europe West, Asia Pacific). To achieve high availability and disaster recovery, you can deploy resources across multiple regions. The exam expects you to know that storing backups in a different region protects against a regional outage. However, this also means you must understand data residency laws: some countries require that certain data never leaves their borders.

## Real-world context

Sarah is a security engineer at a mid-sized retail company that is migrating its customer database to a public cloud. Her manager has asked her to ensure the database is secure. Sarah must understand exactly where her company's responsibility ends and the cloud provider's responsibility begins. 

 First, Sarah selects a cloud provider and chooses the IaaS model because the company needs full control over the database software. The provider is responsible for securing the physical data centre, the network cables, the power supply, and the hypervisor. If a fire destroys the data centre, that is the provider's problem, not Sarah's. 

 Sarah must then configure a virtual machine (VM) to host the database. She must harden the operating system by applying security patches, disabling unnecessary services, and configuring a host-based firewall. The provider does not do this for her. If an attacker exploits an unpatched vulnerability in the operating system, that is Sarah's responsibility. 

 Next, Sarah must configure network security. She creates a virtual private cloud (VPC) with a public subnet and a private subnet. She places the database VM in the private subnet so it has no direct access to the internet. She uses a security group (a stateful firewall) to allow traffic only from the company's application servers. If she accidentally makes the database public, customer data could be exposed, and that is her mistake. 

 Sarah also sets up identity and access management. She creates an IAM role that allows the application server to read from the database but not delete it. She enforces multi-factor authentication for all administrative users. She also rotates access keys every 90 days. If an employee's credentials are compromised because Sarah did not enforce MFA, that is on her. 

 For data protection, Sarah enables encryption at rest using the provider's key management service. She also enables encryption in transit by requiring TLS for all connections to the database. She stores encryption keys in the KMS and restricts access to them using policies. If she deletes the encryption keys accidentally, the data becomes permanently inaccessible, and the provider cannot recover it. 

 Finally, Sarah configures logging and monitoring. She enables cloud logging to capture all API calls and database queries. She sets up alerts for suspicious activity, such as an unexpected login from a foreign IP address. She also performs regular security assessments using the provider's vulnerability scanning tools. 

 In practice, an IT professional like Sarah must constantly ask one question: 'Is this my job or the provider's job?' The answer determines where she spends her time, how she allocates her budget, and what she includes in her incident response plan. The 350-701 exam tests this exact decision-making process.

## Exam focus

The 350-701 exam tests your understanding of the shared responsibility model very directly. Expect multiple-choice questions that describe a scenario and ask who is responsible for a specific security task. The trap is that beginners often assume the provider is responsible for everything, or that the customer is responsible for nothing. The correct answer always depends on the service model (IaaS, PaaS, or SaaS) and the specific layer of the stack. 

 The exam loves to test the following specific concepts: 

 - For an IaaS scenario, the customer is responsible for securing the operating system, applications, and data. The provider is responsible for the physical infrastructure and the hypervisor. A common trap question describes a vulnerability in the hypervisor and asks who must patch it. The answer is always the provider. 

 - For a PaaS scenario, the customer is responsible for the application code and the data. The provider is responsible for the runtime environment and the underlying platform. A trap question might describe a SQL injection vulnerability in the customer's application and ask if the provider should fix it. The answer is no, because the customer controls the code. 

 - For a SaaS scenario, the customer is responsible only for user accounts, data, and application configuration. The provider is responsible for everything else. A trap question might ask who is responsible if a user's account is compromised because they used a weak password — that is always the customer's fault. 

 Another heavily tested area is the distinction between security of the cloud and security in the cloud. The exam will give you a list of tasks (e.g., patch physical servers, configure firewall rules, manage encryption keys, secure the data centre perimeter) and ask which ones belong to the provider and which belong to the customer. Memorise this split: physical security, hypervisor security, and network infrastructure security are the provider's domain. Data security, identity and access management, and application security are the customer's domain. \
\

 The exam also tests the five NIST essential characteristics of cloud computing. Expect a question that lists four characteristics and asks which one is the correct definition. The trap is confusing 'resource pooling' with 'rapid elasticity'. Resource pooling means multiple customers share physical hardware. Rapid elasticity means you can automatically scale resources up and down. \
\

 Finally, the exam tests cloud deployment models. A common scenario is a bank that must keep its customer data on-premises for compliance reasons but wants to use the public cloud for analytics. The correct answer is a hybrid cloud. The trap is choosing 'private cloud' because the bank has compliance requirements, but the question's wording indicates they want to use the public cloud for some workloads, which makes hybrid cloud the correct choice. \
\

 Exam-specific terminology to memorise: 

 'Multi-tenancy': Multiple customers sharing the same physical resources while maintaining logical separation. The provider ensures that one customer cannot access another customer's data. 

 'Data sovereignty': The legal requirement that data must remain within the geographic borders of a specific country. This affects where you deploy your cloud resources. 

 'CSP' (Cloud Service Provider): The company that provides cloud services, such as AWS, Azure, or Google Cloud. 

 'Hypervisor': The software layer that virtualises the physical hardware and allows multiple virtual machines to run on a single physical server. The provider secures the hypervisor in IaaS models. 

 'API security': Application Programming Interface security. Cloud resources are managed through APIs, and these APIs must be secured with authentication, authorisation, and rate limiting. The customer is responsible for securing the APIs they expose. 

 The 350-701 exam will also test your understanding of the difference between a single-region and multi-region architecture. A question might describe a company that wants to ensure its application remains available if an entire data centre goes offline. The correct answer is to deploy resources in multiple regions with a load balancer. The trap is suggesting a single-region deployment with redundant availability zones, which protects against a single server failure but not an entire regional outage.

## Step by step

1. **Choose a Service Model** — You must first decide whether to use IaaS, PaaS, or SaaS for your workload. This decision determines the boundary of your security responsibility. For example, if you choose IaaS for a database, you will be responsible for securing the operating system. If you choose PaaS, the provider handles the OS and you focus on your application code.
2. **Select a Deployment Model** — Decide between public, private, or hybrid cloud based on your compliance and security needs. A regulated industry like healthcare often uses a hybrid model to keep sensitive data on-premises while using the public cloud for less sensitive workloads. This choice affects the scope of your security controls.
3. **Configure Identity and Access Management (IAM)** — Define who can access your cloud resources and what they can do with them. Create IAM roles and policies to enforce the principle of least privilege — grant only the minimum permissions necessary. This is the single most important step because misconfigured IAM is the leading cause of cloud data breaches.
4. **Secure the Network** — Design a virtual network architecture that isolates your resources from the internet where possible. Use security groups (stateful firewalls) and network access control lists (stateless firewalls) to control inbound and outbound traffic. Place sensitive resources like databases in private subnets with no direct internet access.
5. **Enable Encryption and Key Management** — Turn on encryption at rest for all storage services (like databases and file storage) and encryption in transit for all network connections (using TLS). Set up a key management service to store and rotate encryption keys. Restrict access to the keys using IAM policies so only authorised services and users can decrypt data.
6. **Set Up Logging and Monitoring** — Enable cloud logging to capture all API calls, resource changes, and access attempts. Configure alerts for suspicious activity, such as a login from an unusual location or a sudden spike in data transfer. Regularly review logs and use automated tools to detect misconfigurations and vulnerabilities.
7. **Implement Disaster Recovery** — Design a disaster recovery plan that includes automated backups stored in a different geographic region. Set up failover mechanisms so that if the primary region goes offline, traffic is redirected to a secondary region. Test this plan regularly to ensure it works and meets your recovery time objectives.

## Comparisons

### Infrastructure as a Service (IaaS) vs Platform as a Service (PaaS)

**Infrastructure as a Service (IaaS):**
- Customer secures the operating system of their virtual machines
- Customer manages network configurations like firewalls and subnets
- Customer patches their own applications and runtime libraries

**Platform as a Service (PaaS):**
- Provider secures the underlying operating system and runtime environment
- Provider manages the underlying network infrastructure
- Customer only secures their application code and data

### Security of the Cloud vs Security in the Cloud

**Security of the Cloud:**
- Provider is responsible for physical data centre security
- Provider manages hypervisor and network infrastructure patching
- Includes compliance certifications for the provider's facilities

**Security in the Cloud:**
- Customer is responsible for data encryption and key management
- Customer manages identity and access policies for their resources
- Includes application security and network configuration within the customer's virtual environment

### Public Cloud vs Private Cloud

**Public Cloud:**
- Infrastructure is shared across multiple organisations using multi-tenancy
- Lower cost due to economies of scale
- Must rely on logical isolation for security

**Private Cloud:**
- Infrastructure is dedicated to a single organisation
- Higher cost but offers physical isolation
- Customer has full control over the hardware and network

### Single-Region Architecture vs Multi-Region Architecture

**Single-Region Architecture:**
- All resources deployed in one geographic region
- Lower latency for local users but vulnerable to regional outages
- Simpler to manage and less expensive

**Multi-Region Architecture:**
- Resources deployed across multiple geographic regions
- High availability and disaster recovery against regional failures
- More complex to manage and higher data transfer costs

## Diagram

_Flowchart showing the split of responsibilities between the cloud provider and the customer under the shared responsibility model._

```mermaid
flowchart TD
    A[Shared Responsibility Model] --> B[Provider Responsibilities]
    A --> C[Customer Responsibilities]
    B --> D[Physical Security]
    B --> E[Network Infrastructure]
    B --> F[Hypervisor Security]
    C --> G[Identity & Access Management]
    C --> H[Data Encryption]
    C --> I[Application Security]
    C --> J[Network Configuration]
    D --> K[Data Centre]
    E --> L[Cables and Routers]
    G --> M[IAM Roles and Policies]
    H --> N[Key Management]
    I --> O[Code and Config]
    J --> P[Firewalls and Subnets]
```

## Common misconceptions

- **Misconception:** The cloud provider is responsible for all security because they own the hardware. **Reality:** The provider is responsible only for the security of the cloud (physical infrastructure, network, and hypervisor). The customer is responsible for security in the cloud (data, identities, configurations, and applications). (This mistake is common because people think 'renting' means the landlord handles everything, much like renting an apartment. But renting cloud infrastructure is more like renting an empty house where you must install your own locks and alarm system.)
- **Misconception:** Data encryption means the provider cannot read my data, so I do not need to worry about access controls. **Reality:** Encryption protects data from unauthorised access during transmission and at rest, but it does not protect against authorised users who misuse their access. You must still enforce identity and access management (IAM) policies and the principle of least privilege. (People overestimate encryption because it sounds like a magic shield. In reality, encryption is just one layer; the keys that unlock the data are controlled by IAM, and if a user with legitimate access steals the data, encryption does not stop them.)
- **Misconception:** The shared responsibility model is the same for every cloud service model. **Reality:** The model changes significantly depending on whether you use IaaS, PaaS, or SaaS. In IaaS, you handle the operating system and applications. In PaaS, the provider handles the runtime. In SaaS, the provider handles nearly everything except your data and user accounts. (Beginners often think 'the cloud' is one single thing. In reality, the three service models shift the responsibility boundary up or down the stack, and the exam specifically tests your understanding of these differences.)
- **Misconception:** If I use a public cloud, my data is not secure because other tenants share the same hardware. **Reality:** Public cloud providers use strong logical isolation mechanisms such as hypervisors, virtual LANs, and encryption to ensure tenants cannot access each other's data. The risk is not from other tenants but from misconfigured services, weak passwords, or overly permissive IAM policies set by the customer. (The word 'public' sounds insecure to people unfamiliar with cloud architecture. They imagine a shared locker room where anyone can open anyone else's locker. In reality, each tenant's data is isolated by software controls that are rigorously tested and monitored.)
- **Misconception:** Moving to the cloud eliminates the need for a disaster recovery plan. **Reality:** The cloud provides tools for disaster recovery, such as multi-region replication and automated backups, but the customer must still design and implement the disaster recovery strategy. The provider does not automatically protect you from a regional outage if you only deploy resources in a single region. (People assume cloud providers are invincible. Providers do have impressive redundancy, but a customer who deploys everything in one availability zone will still lose access if that zone fails. The responsibility for designing resilience is on the customer.)

## Key takeaways

- The shared responsibility model splits security duties between the cloud provider and the customer based on the service model (IaaS, PaaS, or SaaS).
- The provider is responsible for the security of the cloud (physical data centres, network infrastructure, and hypervisor).
- The customer is always responsible for their data, user identities, and the configuration of access controls.
- In IaaS, the customer secures the operating system and applications; in PaaS, only the application code and data; in SaaS, only data and user accounts.
- The five NIST essential characteristics of cloud computing are on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.
- Data sovereignty laws may restrict where you can store data geographically, so multi-region architecture must account for legal requirements.
- Encryption at rest and in transit is available from the provider, but the customer must enable it and manage the encryption keys.
- Public cloud uses multi-tenancy with logical isolation; the risk of other tenants accessing your data is negligible compared to the risk of your own misconfigurations.
- Identity and access management (IAM) is a customer responsibility and is the most common source of cloud security breaches.

## FAQ

**What is the shared responsibility model in cloud computing?**

The shared responsibility model defines which security tasks are handled by the cloud provider and which are handled by the customer. The provider secures the physical infrastructure and the hypervisor, while the customer secures their data, identities, and configurations. The exact split depends on whether you use IaaS, PaaS, or SaaS.

**Who is responsible for patching the operating system in IaaS?**

In IaaS, the customer is responsible for patching the operating system of their virtual machines. The provider patches the underlying hypervisor but does not have access to the customer's VM to install OS updates.

**Is my data safe in a public cloud?**

Your data is safe if you configure your security correctly. The provider uses strong logical isolation to separate tenants, so other customers cannot access your data. The real risk comes from your own misconfigurations, such as leaving a storage bucket publicly accessible or using weak passwords.

**What is the difference between IaaS, PaaS, and SaaS?**

IaaS provides virtual machines, storage, and networks that you manage yourself. PaaS provides a platform where you deploy your own code and the provider manages the runtime. SaaS provides a fully built application that you use through a web browser, with the provider managing almost everything.

**What is multi-tenancy in cloud computing?**

Multi-tenancy is a model where multiple customers share the same physical hardware and resources, but their data and workloads are logically isolated using software controls like hypervisors and virtual networks. It is how public cloud providers achieve economies of scale.

**What does 'security in the cloud' mean compared to 'security of the cloud'?**

'Security of the cloud' refers to the measures the provider takes to protect the underlying infrastructure, such as physical data centre security and hypervisor patching. 'Security in the cloud' refers to what the customer does to protect their own resources, such as configuring firewalls, managing identities, and encrypting data.

**Do I need a disaster recovery plan if I use the cloud?**

Yes. The cloud provides the tools for disaster recovery, but you must design and implement the plan yourself. If you only deploy resources in a single region, a regional outage will still affect you. You must actively choose multi-region deployment and automated backups to achieve resilience.

## Check your understanding

1. **In the shared responsibility model, who is responsible for patching the hypervisor in an IaaS deployment?**

   Answer: The cloud provider is responsible for patching the hypervisor, as it is part of the security of the cloud.

2. **A company uses a SaaS application. An employee's account is compromised because they shared their password with a colleague. Who is responsible for this breach?**

   Answer: The customer is responsible, as user account security always falls under the customer's responsibilities in any service model.

3. **What is the key difference between resource pooling and rapid elasticity in the NIST definition of cloud computing?**

   Answer: Resource pooling means multiple customers share physical hardware, while rapid elasticity means resources can be automatically scaled up or down on demand.

4. **A bank wants to keep sensitive customer data on its own hardware for compliance but use the public cloud for analytics. Which cloud deployment model is most appropriate?**

   Answer: A hybrid cloud model is most appropriate, as it allows the bank to keep sensitive data on-premises while using the public cloud for other workloads.

5. **What is the customer's responsibility regarding encryption when using a PaaS offering?**

   Answer: The customer must enable encryption at rest and in transit for their data and manage the encryption keys, even though the provider offers the encryption mechanisms.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/cisco-ccnp-security/cloud-security-fundamentals