# Cloud Security Architecture & Hardening: Build It Secure, Keep It Secure Canonical URL: ## Overview This is a two-part course that separates designing a secure cloud from keeping it secure. The first part is architecture: trust boundaries and shared responsibility, identity as the real control plane, network segmentation, data protection and cryptography, and secure configuration baselines. The second is operations: workloads, containers and serverless, application and API security, logging and detection, resilience and recovery, and a closing workshop. The identity module is the center of gravity, and it is anchored to real incidents rather than hypotheticals, working through the 2024 Snowflake tenant breach and the Storm-0558 signing-key compromise, which between them cover the two failure modes that matter most: credentials without strong authentication on a non-SSO path, and compromise of a trust anchor itself. Naming real breaches is deliberate, since most competing cloud security training is vendor-certification prep and will not go near them. The course is current in ways most cloud training is not. It uses the CNAPP vocabulary buyers are now hearing from vendors and breaks it into its actual parts, CSPM, CWPP and CIEM. It covers post-quantum cryptography migration for cloud key management, which very few cloud security courses have yet and which organizations are starting to be asked about, and it includes service mesh proxy architecture per NIST SP 800-233, CISA's SCuBA baselines, and FedRAMP's shift to the 20x authorization model. The closing workshop hands participants a fictional cloud architecture and asks for a prioritized, defended hardening plan. ## What you'll learn - Define cloud security architecture, identify trust boundaries, and apply shared responsibility to real control ownership - Distinguish human identities from workload and service identities, and apply least privilege across both - Identify excessive permissions, stale identities and privilege escalation paths using entitlement management - Design segmented cloud networks and apply Zero Trust principles per NIST SP 800-207 and 800-207A - Protect data at rest, in transit and in processing, and manage the cryptographic key lifecycle - Establish secure configuration baselines and detect drift from them - Harden compute, containers and serverless workloads, and protect images and registries - Secure applications and APIs, including service-to-service trust and secrets handling - Build security logging and detection coverage across identity, network, workload and administrative activity - Design for resilience and prepare for compromised identities, workloads and accounts - Produce and defend a prioritized cloud-hardening plan ## Prerequisites Foundational knowledge of cloud computing. ## Curriculum #### Module 1 - Draw the Boundary: Cloud Security Architecture Foundations - Service and deployment models - Security design principles - Assets, resources and trust boundaries - Shared responsibility - Control ownership versus inherited capability - Common attack surfaces - Defense in depth - CNAPP as the umbrella over CSPM, CWPP and CIEM #### Module 2 - Identity Is the Control Plane: IAM Architecture - Identities, roles, permissions and entitlements - Human versus workload identity - Least privilege - Role-based and attribute-based access - Privileged access and administrative separation - Stronger authentication including legacy non-SSO paths - Entitlement management - Case studies on the 2024 Snowflake tenant breach and the Storm-0558 signing-key compromise #### Module 3 - Trust No Network: Cloud Network Security Architecture - Security zones and trust boundaries - Virtual networks, subnets, routing and gateways - Segmentation and microsegmentation - Inbound and outbound control - Security groups and filtering - Protecting management interfaces - Zero Trust per NIST SP 800-207 and 800-207A - Service mesh proxy architecture per SP 800-233 #### Module 4 - Protect the Data: Cloud Data Security & Cryptography - Classification - Protection at rest, in transit and in processing per NIST IR 8505 - Encryption across storage, databases and applications - Key lifecycle management - Organization-managed versus provider-managed keys, BYOK and HYOK - Secrets, tokens, certificates and API keys - Minimization, retention and secure deletion - Post-quantum cryptography migration - FIPS 140-3 and SP 800-57 for federal environments #### Module 5 - Harden the Foundation: Secure Cloud Configuration - Baselines using NIST guidance, the CSA Cloud Controls Matrix and CIS Benchmarks - Insecure defaults and unnecessary services - Hardening management planes - Restricting public exposure - Least functionality - Configuration drift detection - Managing approved exceptions - The FedRAMP 20x model for federal environments #### Module 6 - Lock Down the Workload: Compute, Containers & Serverless - Hardening instances and operating systems - Protecting images, templates and deployment artifacts - Container isolation and runtime security - Protecting registries against malicious and typosquatted images - Serverless security and emerging abuse patterns - Reducing workload privilege - The NIST SP 800-204 series for cloud-native architectures #### Module 7 - Secure the Front Door: Applications, APIs & Services - Application attack surfaces - Application-to-application communication - API authentication and authorization per NIST SP 800-228 Update 1 - Secure API gateways - Service identity and service-to-service trust - Protecting secrets without relying on environment variables - Secure development per SP 800-218 and 800-218A #### Module 8 - See Everything: Logging, Monitoring & Detection - Identifying security-relevant logs and telemetry - Enabling logging across identity, network, workload and administrative activity - Centralization and retention - Protecting logs from alteration - Alerting on suspicious administrative activity - Detecting drift - Supporting investigation - CISA SCuBA baselines as a mandated example #### Module 9 - Assume Something Breaks: Resilience, Recovery & Incident Readiness - Designing for availability - Single points of failure and critical dependencies - Redundancy and fault tolerance - Protecting backups - Recovery objectives and restoration priorities - Preparing for compromised identities, workloads and accounts including a compromised trust anchor - NIST SP 1800-35 #### Module 10 - Architect, Harden, Defend: Cloud Security Workshop - Review a fictional architecture, identify trust boundaries and insecure exposure, evaluate identity and privileged access risk against a real recent breach, assess segmentation, data protection and key management including post-quantum timing, then build and defend a prioritized hardening plan ## Schedule - Jan 4, 2027 – Jan 5, 2027 — Live Online - Feb 23, 2027 – Feb 24, 2027 — Live Online - Mar 15, 2027 – Mar 16, 2027 — Live Online - Apr 29, 2027 – Apr 30, 2027 — Live Online - May 24, 2027 – May 25, 2027 — Live Online - Jun 15, 2027 – Jun 16, 2027 — Live Online - Jul 29, 2027 – Jul 30, 2027 — Live Online ## Pricing **Tuition:** $899