# Cloud Security Architecture & Hardening: Build It Secure, Keep It Secure (Self-Paced)

Canonical URL: <https://www.nobledesktop.com/classes/cloud-security-architecture-and-hardening-self-paced>

## Overview

Two halves, treating the design of a secure cloud and the upkeep of one as genuinely different jobs. The first half is architecture: trust boundaries and shared responsibility, identity as the control plane it really is, network segmentation, data protection and cryptography, and secure configuration baselines. The second is operations: workloads, containers and serverless, application and API security, logging and detection, resilience and recovery, and a workshop to close. Identity is where the weight of the course falls, and it is taught from incidents that actually happened — the 2024 Snowflake tenant breach and the Storm-0558 signing-key compromise are each worked through in detail, because between them they cover the two failures that matter most: credentials sitting on a non-SSO path without strong authentication, and the compromise of a trust anchor itself. Naming real breaches is a deliberate choice; most competing cloud security training is certification prep and will not touch material this specific.

The content is unusually current. It takes the CNAPP vocabulary vendors are now selling and breaks it back into the parts it is made of — CSPM, CWPP and CIEM. It covers post-quantum cryptography migration for cloud key management, which barely any cloud security course carries yet and which organizations are increasingly asked to show a timeline for, and it takes in service mesh proxy architecture per NIST SP 800-233, CISA's SCuBA baselines, and FedRAMP's move to the 20x authorization model. The final module puts a fictional cloud architecture in front of you and asks for a prioritized hardening plan you can defend.

## What you'll learn

- Define cloud security architecture, identify trust boundaries, and apply shared responsibility to real control ownership
- Distinguish human identities from workload and service identities, and apply least privilege across both
- Identify excessive permissions, stale identities and privilege escalation paths using entitlement management
- Design segmented cloud networks and apply Zero Trust principles per NIST SP 800-207 and 800-207A
- Protect data at rest, in transit and in processing, and manage the cryptographic key lifecycle
- Establish secure configuration baselines and detect drift from them
- Harden compute, containers and serverless workloads, and protect images and registries
- Secure applications and APIs, including service-to-service trust and secrets handling
- Build security logging and detection coverage across identity, network, workload and administrative activity
- Design for resilience and prepare for compromised identities, workloads and accounts
- Produce and defend a prioritized cloud-hardening plan

## Prerequisites

Foundational knowledge of cloud computing.

## Pricing

**Tuition:** $899