# Cloud Security Architecture & Hardening: Build It Secure, Keep It Secure Course (Self-Paced) Canonical URL: ## Overview This course comes in two halves that treat designing a secure cloud and keeping it secure as different jobs. The first half is architecture: trust boundaries and shared responsibility, identity as the real control plane, network segmentation, data protection and cryptography, and secure configuration baselines. The second is operations: workloads, containers and serverless, application and API security, logging and detection, resilience and recovery, and a closing workshop. Identity is where the course spends its weight, and it teaches from real incidents — the 2024 Snowflake tenant breach and the Storm-0558 signing-key compromise are worked through in detail because between them they cover the two failure modes that matter most: credentials without strong authentication on a non-SSO path, and compromise of a trust anchor itself. Most competing cloud security training is vendor-certification prep and will not touch material this specific. The content is unusually current. It uses the CNAPP vocabulary vendors are now selling and breaks it into its real parts, CSPM, CWPP and CIEM. It covers post-quantum cryptography migration for cloud key management, a genuine differentiator that few cloud courses carry yet and that agencies are increasingly asked to show a timeline for, and it includes service mesh proxy architecture per NIST SP 800-233, CISA's SCuBA baselines, and FedRAMP's shift to the 20x authorization model. The final module hands learners a fictional cloud architecture and asks for a prioritized, defended hardening plan. It follows directly from [Cloud Security Fundamentals for Federal Employees (Self-Paced)](https://www.graduateschool.edu/courses/cloud-security-fundamentals-for-federal-employees-self-paced), which covers the same ground one level down. ## What you'll learn - Define cloud security architecture, identify trust boundaries, and apply shared responsibility to real control ownership - Distinguish human identities from workload and service identities, and apply least privilege across both - Identify excessive permissions, stale identities and privilege escalation paths using entitlement management - Design segmented cloud networks and apply Zero Trust principles per NIST SP 800-207 and 800-207A - Protect data at rest, in transit and in processing, and manage the cryptographic key lifecycle - Establish secure configuration baselines and detect drift from them - Harden compute, containers and serverless workloads, and protect images and registries - Secure applications and APIs, including service-to-service trust and secrets handling - Build security logging and detection coverage across identity, network, workload and administrative activity - Design for resilience and prepare for compromised identities, workloads and accounts - Produce and defend a prioritized cloud-hardening plan ## Prerequisites Foundational knowledge of cloud computing. ## Curriculum #### Module 1 - Draw the Boundary: Cloud Security Architecture Foundations - Service and deployment models - Security design principles - Assets, resources and trust boundaries - Shared responsibility - Control ownership versus inherited capability - Common attack surfaces - Defense in depth - CNAPP as the umbrella over CSPM, CWPP and CIEM #### Module 2 - Identity Is the Control Plane: IAM Architecture - Identities, roles, permissions and entitlements - Human versus workload identity - Least privilege - Role-based and attribute-based access - Privileged access and administrative separation - Stronger authentication including legacy non-SSO paths - Entitlement management - Case studies on the 2024 Snowflake tenant breach and the Storm-0558 signing-key compromise #### Module 3 - Trust No Network: Cloud Network Security Architecture - Security zones and trust boundaries - Virtual networks, subnets, routing and gateways - Segmentation and microsegmentation - Inbound and outbound control - Security groups and filtering - Protecting management interfaces - Zero Trust per NIST SP 800-207 and 800-207A - Service mesh proxy architecture per SP 800-233 #### Module 4 - Protect the Data: Cloud Data Security & Cryptography - Classification - Protection at rest, in transit and in processing per NIST IR 8505 - Encryption across storage, databases and applications - Key lifecycle management - Organization-managed versus provider-managed keys, BYOK and HYOK - Secrets, tokens, certificates and API keys - Minimization, retention and secure deletion - Post-quantum cryptography migration - FIPS 140-3 and SP 800-57 for federal environments #### Module 5 - Harden the Foundation: Secure Cloud Configuration - Baselines using NIST guidance, the CSA Cloud Controls Matrix and CIS Benchmarks - Insecure defaults and unnecessary services - Hardening management planes - Restricting public exposure - Least functionality - Configuration drift detection - Managing approved exceptions - The FedRAMP 20x model for federal environments #### Module 6 - Lock Down the Workload: Compute, Containers & Serverless - Hardening instances and operating systems - Protecting images, templates and deployment artifacts - Container isolation and runtime security - Protecting registries against malicious and typosquatted images - Serverless security and emerging abuse patterns - Reducing workload privilege - The NIST SP 800-204 series for cloud-native architectures #### Module 7 - Secure the Front Door: Applications, APIs & Services - Application attack surfaces - Application-to-application communication - API authentication and authorization per NIST SP 800-228 Update 1 - Secure API gateways - Service identity and service-to-service trust - Protecting secrets without relying on environment variables - Secure development per SP 800-218 and 800-218A #### Module 8 - See Everything: Logging, Monitoring & Detection - Identifying security-relevant logs and telemetry - Enabling logging across identity, network, workload and administrative activity - Centralization and retention - Protecting logs from alteration - Alerting on suspicious administrative activity - Detecting drift - Supporting investigation - CISA SCuBA baselines as a mandated example #### Module 9 - Assume Something Breaks: Resilience, Recovery & Incident Readiness - Designing for availability - Single points of failure and critical dependencies - Redundancy and fault tolerance - Protecting backups - Recovery objectives and restoration priorities - Preparing for compromised identities, workloads and accounts including a compromised trust anchor - NIST SP 1800-35 #### Module 10 - Architect, Harden, Defend: Cloud Security Workshop - Review a fictional architecture, identify trust boundaries and insecure exposure, evaluate identity and privileged access risk against a real recent breach, assess segmentation, data protection and key management including post-quantum timing, then build and defend a prioritized hardening plan ## Pricing **Tuition:** $899