Web security
The Cloud Shared Responsibility Model Explained
Moving to the cloud does not move the security job to the provider. It splits it. The shared responsibility model says who handles what, and most cloud breaches happen on the customer side of that line.
The Idea
The provider secures the cloud itself: data centers, hardware, the virtualization layer. You secure what you put in the cloud: your accounts, configuration, data and applications. The exact split depends on the service type.
How It Shifts by Service Type
- IaaS (virtual machines): you manage the operating system, patching, firewall rules, applications and data. The provider manages the hardware beneath.
- PaaS (platforms): the provider also manages the operating system and runtime. You manage your code, data and access.
- SaaS (ready-made software): the provider runs nearly everything. You still own user accounts, access settings and the data you store.
In every model, identity and data stay with you.
Common Customer-Side Mistakes
- Storage buckets left open to the public.
- Over-broad access roles, or keys committed to code.
- No multi-factor authentication on admin accounts.
- Logging turned off, so nobody sees what happened.
- Unpatched virtual machines.
Practice Safely
Use a free-tier account you own, set a billing alert and review every permission you grant. Never test against accounts or resources you do not own. Cloud applications are web applications underneath, so OWASP Top 10 and SSRF still apply.
Where This Leads
EC-Council's CCSE covers cloud security in 11 modules; see the CCSE exam guide.
Sources and Further Reading
Want guided practice with web and API security? Book free trial classes. Contact us or call +91 86868 92922.
Courses Mentioned in This Guide
More Guides
Prowler for Beginners: Audit an AWS Account for Misconfigurations
Use Prowler to audit an AWS account you own: create read-only access, run a scan, filter by severity and turn findings into a fix list.
Read the guide →EC-Council CCSE: Exam Format, Eligibility and 11 Modules
What the EC-Council CCSE exam looks like: 125 questions in 4 hours, 70% to pass, 11 modules across AWS, Azure and GCP, and who cloud security suits.
Read the guide →How to Prepare for WAHS: A Web Hacking Practice Plan
A 6-week practice plan for a hands-on web hacking exam like WAHS: weekly topics, practice targets, note-taking habits and timed 6-hour drills.
Read the guide →ffuf Commands for Beginners: Find Hidden Web Paths in a Lab
ffuf commands and cheat sheet: find directories and files, use filters and rate limits and read the results, with examples for a lab you own.
Read the guide →Start Your Cyber Security Career
Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.
- Call+91 86868 92922
Open 7 days: Mon to Fri 8:30 AM to 8:30 PM IST
Sat and Sun 10 AM to 6 PM IST - Emailinfo@hackingtrainer.com
- VisitGround Floor, G-3, Sri Venkatasai Nest, Kallu Compound Road, Nagarjuna Nagar Colony, Yella Reddy Guda, Ameerpet, Hyderabad – 500073
Open in Google Maps