Chapter 1 — Security foundations for practitioners
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The starting point"]
N2["1.2 What changes in the cloud"]
N3["1.3 Security goals for permits"]
N4["1.4 Shared responsibility"]
N5["1.5 Working as a professional"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The starting point"]
N2["1.2 What changes in the cloud"]
N3["1.3 Security goals for permits"]
N4["1.4 Shared responsibility"]
N5["1.5 Working as a professional"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The starting point]
|
v
[1.2 What changes in the cloud]
|
v
[1.3 Security goals for permits]
|
v
[1.4 Shared responsibility]
|
v
[1.5 Working as a professional]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame cloud security for an experienced administrator; (2) apply confidentiality, integrity and availability to a public service; (3) use the shared responsibility model in daily decisions.
1.1 The starting point
Hannah Kowalski has run servers for the fictional Elmstead Council for twelve years. The council has moved its parking-permit service to containers on a managed Kubernetes cluster, and Hannah is taking a six-month professional course at the fictional Kingsbridge Professional Institute while moving into a cloud security role. Her supervisor is Dev Patel, the council's head of infrastructure. An internal audit has just reported two concerns about the permit service: cloud roles with far more access than needed, and container images with known vulnerabilities that nobody had prioritised.
1.2 What changes in the cloud
Hannah's experience still applies: least privilege, patching, logging and change control. What changes is that infrastructure is configured through APIs, identities are numerous and often belong to automation, and the provider runs part of the stack. NIST SP 800-145 describes the on-demand, self-service nature of cloud, which makes it easy to grant access quickly and hard to notice when it is too much. For the permit service, this means a deploy bot and background jobs hold as many permissions as staff do, and nobody reviews them unless someone asks.
1.3 Security goals for permits
Residents' names, addresses and vehicle registrations must stay confidential; permit records must be accurate so enforcement officers act on correct data; and the service must stay available because residents need permits to park legally. Each goal points to a different part of the audit. Excess permissions threaten confidentiality and accuracy, because a compromised workload could read or alter records. Unpatched images threaten all three. Hannah writes the goals at the top of her method note, so every later decision about what to fix first can be checked against them.
1.4 Shared responsibility
The provider secures the hardware, the managed control plane and its own services. The council configures identities, network rules, workloads and data protection, as each major provider's shared responsibility page explains. The audit findings fall entirely on the council's side. This matters for how the work is framed: the council cannot wait for the provider to fix its roles or images, and it cannot blame the provider for findings in its own configuration. Hannah notes which parts the provider runs, so her evidence covers only what the council controls and can change.
1.5 Working as a professional
Hannah's course expects her to apply methods at work, with evidence, under her organisation's authority, and to stay within agreed scope. At Elmstead this means working under a written brief signed by Dev and the information security officer, keeping evidence for each step, and proposing changes through the council's normal change process rather than making them directly. When something falls outside her brief, she reports it instead of acting on it. Her portfolio for Kingsbridge assessors is built from the same evidence she produces for the council, so the course and the job reinforce each other.
Worked example
Dev asks Hannah where the audit findings sit in the shared responsibility model. She explains that both roles and images are configured by the council: the provider supplies the identity service and registry, but the council decides who gets which permissions and which images it runs. Dev agrees that this frames the work as the council's own improvement.
Synthetic case. Hannah, Dev, Elmstead Council and Kingsbridge are synthetic.
Errors and limits
Experienced administrators can over-trust familiar habits; cloud identities and automation need fresh attention.
Exercises
- EX001 — Audit concerns. Name the two audit concerns. Rubric: 3 = broad roles; unprioritised vulnerable images; 2 = one; 1 = vague; 0 = none.
- EX002 — What stays the same. Which of Hannah's existing practices still apply? Rubric: 3 = least privilege, patching, logging, change control; 2 = three; 1 = two; 0 = none.
- EX003 — Permit goals. Apply the three security goals to permits. Rubric: 3 = resident data private, records accurate, service available; 2 = two; 1 = one; 0 = none.
- EX004 — Responsibility placement. Where do the audit findings sit in shared responsibility? Rubric: 3 = council side; 2 = partial; 1 = vague; 0 = none.
- EX005 — Self-service risk. Why does self-service make excessive access common? Rubric: 3 = easy to grant, hard to notice; 2 = partial; 1 = vague; 0 = none.
Synthesis
Bring existing discipline, but pay fresh attention to identities and automation.