Cloud Security Architecture Training Course

Participants can apply security principles to select appropriate cloud architecture patterns.

• Defence in depth applied to cloud management and workload planes
• Zero Trust principles translated into identity, device and network requirements
• Secure-by-design principles incorporated into architecture decision records
• Reference architectures compared for single-account and multi-account deployments
• Security design principles prioritised against availability, cost and operational constraints
• Architecture decision records capture options, trade-offs and residual risks

Participants can map cloud architecture controls to recognised security and assurance frameworks.

• NIST CSF 2.0 functions mapped to cloud architecture control objectives
• CSA Cloud Controls Matrix used to assess provider control coverage
• CIS Benchmarks interpreted for hardened cloud service configurations
• ISO 27001 control themes linked to cloud architecture evidence
• Control inheritance documented for shared platforms and managed services
• Responsibility assignment matrices distinguish platform, product and security accountabilities

Participants can design governed cloud landing zones with clear account and policy structures.

• Landing zone components defined for identity, networking, logging and billing
• Account and subscription structures aligned with business and risk boundaries
• Management groups and organisational units enforce delegated governance models
• Guardrails implemented through service control policies and resource policies
• Centralised logging accounts separated from workload administration responsibilities
• Naming, tagging and ownership standards support inventory and incident response

Participants can create identity architectures based on federation, least privilege and privileged access controls.

• Identity providers integrated through SAML, OpenID Connect and federation
• Least-privilege permissions derived from defined business and operational tasks
• Role-based access control compared with attribute-based access control models
• Privileged access workflows designed with approval, expiry and session recording
• Machine identities separated from human administrator credentials and permissions
• Access reviews scheduled using entitlement inventories and risk-based prioritisation

Participants can specify cloud network security patterns for internal, external and hybrid connectivity.

• Network segmentation designed using virtual networks, subnets and security groups
• Ingress controls protect internet-facing applications through web application firewalls
• Egress filtering restricts workload communications to approved destinations only
• Private endpoints minimise public exposure for platform service connections
• Hybrid connectivity assessed for routing, inspection and trust boundary implications
• DNS security controls address resolution, split-horizon and domain takeover risks

Participants can define data protection architectures for cloud data stores and processing services.

• Data classification drives storage, processing, retention and transfer requirements
• Encryption requirements distinguish data at rest, transit and use
• Key management architectures compare provider-managed, customer-managed and external keys
• Envelope encryption patterns protect high-value data with separated key access
• Secrets management replaces embedded passwords, tokens and connection strings
• Data residency constraints assessed against regions, backups and support access

Participants can design workload protection controls for virtual machines, containers and Kubernetes services.

• Golden image pipelines establish approved operating system configuration baselines
• CIS Benchmarks guide virtual machine and container host hardening
• Container image scanning identifies vulnerable packages before registry publication
• Kubernetes admission controls enforce trusted images and restricted configurations
• Runtime protection detects suspicious processes, network activity and privilege escalation
• Vulnerability management prioritises remediation using exploitability and asset criticality

Participants can select security controls for managed application services, serverless functions and APIs.

• Serverless execution roles restricted to minimum required service permissions
• API gateways enforce authentication, authorisation, throttling and request validation
• OWASP API Security Top 10 informs interface threat identification
• Managed database access controlled through private connectivity and identity-based authentication
• Function secrets retrieved dynamically from approved secrets management services
• Event-driven architectures assessed for source validation and message tampering risks

Participants can conduct structured threat modelling and convert findings into architecture controls.

• STRIDE analysis applied to cloud data flows and trust boundaries
• Attack trees model attacker objectives, paths and defensive control points
• Abuse cases identify misuse of administrative and customer-facing capabilities
• Threat scenarios prioritised using likelihood, impact and control effectiveness
• Architecture diagrams annotated with assets, entry points and threat agents
• Mitigation decisions recorded with owners, deadlines and acceptance criteria

Participants can design logging and detection architectures that support investigation and response.

• Audit logs collected from identity, control plane and data services
• Log retention periods aligned with investigation, regulatory and storage requirements
• SIEM ingestion patterns preserve timestamps, source context and integrity
• Detection use cases address privilege escalation, anomalous access and data exfiltration
• Cloud-native security posture findings routed through triage and remediation workflows
• Alert severity models combine asset criticality, confidence and business impact

Participants can incorporate incident response and forensic readiness requirements into cloud designs.

• Cloud incident playbooks define containment, eradication, recovery and communications actions
• Forensic readiness preserves audit trails, snapshots and immutable evidence stores
• Compromised credential scenarios test token revocation and access containment procedures
• Break-glass access designed with controlled activation and post-incident review
• Provider escalation routes documented for security events and legal requests
• Recovery communications align technical status, business impact and decision authority

Participants can design secure resilience and recovery controls for cloud workloads.

• Recovery objectives translated into architecture requirements for critical services
• Backup designs protect copies through encryption, immutability and access separation
• Multi-region architectures assessed against data residency and dependency risks
• Ransomware recovery plans include clean-room restoration and credential rotation
• Dependency mapping identifies recovery risks from identity, DNS and key services
• Resilience testing evidence documents recovery times and control failures

Participants can integrate architecture security controls into infrastructure and software delivery pipelines.

• Infrastructure as code templates enforce approved cloud architecture patterns
• Policy as code evaluates resource configurations before deployment approval
• Security gates combine secret scanning, dependency scanning and configuration checks
• Exception workflows record compensating controls, expiry dates and accountable owners
• Continuous compliance compares deployed resources against approved configuration baselines
• Pipeline evidence retained for audit trails and release assurance

Participants can assess cloud security risks and prepare evidence for architecture assurance decisions.

• Risk registers capture threat, vulnerability, impact, treatment and ownership
• Control-gap analysis compares target architecture against required control objectives
• Residual risk statements explain accepted exposure and approval requirements
• Third-party assessments examine assurance reports, contracts and service dependencies
• Security architecture reviews test designs against defined acceptance criteria
• Evidence packs organise diagrams, configurations, test results and exceptions

Participants can assess security implications of multi-cloud platforms and SaaS service integrations.

• Multi-cloud identity patterns reduce duplicate accounts and inconsistent entitlements
• Cross-cloud connectivity assessed for routing, encryption and inspection requirements
• SaaS integrations reviewed for OAuth scopes, data sharing and administrator access
• Cloud access security broker functions evaluated for visibility and policy enforcement
• Data transfer architectures address tokenisation, encryption and contractual restrictions
• Common control patterns adapted without assuming identical provider capabilities

Participants can build, review and present a complete cloud security architecture package for a defined business service.

• Business requirements translated into security objectives, assumptions and architecture constraints
• Target architecture diagrams show identity, network, data and logging controls
• STRIDE threat model identifies priority risks and required mitigations
• Control matrix maps design decisions to NIST CSF and CSA CCM
• Implementation roadmap sequences foundational controls, workload changes and assurance activities
• Architecture review presentation defends residual risks, trade-offs and investment priorities