Chapter 1 — Cloud and container security: foundations and decisions
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The trigger"]
N2["1.2 What cloud means here"]
N3["1.3 Containers in plain terms"]
N4["1.4 Who does what"]
N5["1.5 Proportionate decisions"]
N6["1.6 Recording decisions"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The trigger"]
N2["1.2 What cloud means here"]
N3["1.3 Containers in plain terms"]
N4["1.4 Who does what"]
N5["1.5 Proportionate decisions"]
N6["1.6 Recording decisions"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The trigger]
|
v
[1.2 What cloud means here]
|
v
[1.3 Containers in plain terms]
|
v
[1.4 Who does what]
|
v
[1.5 Proportionate decisions]
|
v
[1.6 Recording decisions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain what cloud and container services a small clinic relies on; (2) use the shared responsibility model to see what the clinic must do; (3) make proportionate first decisions.
1.1 The trigger
Leila Ahmadi is the practice manager and only IT person at the fictional Oakfield Physiotherapy, a clinic with eight staff. The clinic stores letters, referrals and invoices in a cloud storage service and runs an online booking app that a local developer packaged as a container on a small hosted platform. In April a patient mentions that a link to her own treatment letter, forwarded by mistake, opened without any login. Leila realises the patient letters folder is shared with "anyone with the link". She joins a one-month rapid course at the fictional Westbrook Community College, with tutor Ben Hartley, to fix this and set up sensible routines.
1.2 What cloud means here
NIST SP 800-145 describes cloud computing as on-demand access to shared computing resources managed by a provider. For Oakfield, that means the storage service, the email service and the hosted platform running the booking container. The clinic owns no servers.
Because Oakfield owns no servers, every security question becomes a question about accounts and settings in someone else's service. The patient letters folder shows it: no hardware was broken into; one sharing setting in the storage service, chosen by a colleague in January, made a folder of treatment letters open to anyone holding a link.
1.3 Containers in plain terms
A container is a packaged application with everything it needs to run. The booking app container was built by the developer from a base image; if the base image is old, the app inherits its flaws even if the clinic never touches the code.
The clinic sees only the booking pages, so the age of the base image was invisible to Leila until she asked. The developer's answer, an older image last rebuilt a year ago, meant a year of fixes to the image's system libraries had never reached the clinic's app, even though nobody had changed the app's own code.
1.4 Who does what
Each provider's shared responsibility page explains that the provider secures its infrastructure while the customer controls accounts, sharing settings, data and what it runs. Oakfield's sharing mistake sits entirely on the clinic's side.
The storage provider's systems worked exactly as designed: a link set to "anyone with the link" opened without login because the clinic had chosen that setting. No complaint to the provider would have fixed it. The booking container is split: the hosting company runs the platform, the developer builds the image, and the clinic must agree how often it is rebuilt.
1.5 Proportionate decisions
A small clinic cannot do everything at once. Ben suggests three first decisions: fix sharing on sensitive folders today, turn on multi-factor authentication for every account this week, and agree with the developer how the booking container will be kept updated.
The order follows harm and effort. The open folder was exposing patient letters now, and fixing it took one setting change, so it came first, that afternoon. Multi-factor authentication needed every staff member's time and two hardware keys, so it took the week. The container needed the developer's agreement, so the first step there was a conversation, not a change.
1.6 Recording decisions
Leila writes each decision with date, reason and owner in a one-page log.
The first entries show the pattern: "Patient letters folder set to staff-only — April, afternoon of the patient's report — exposure of treatment letters — Leila." When Mark later decided, as data controller, how to handle the exposure, his decision went into the same log with its reason. A log kept from the first day means that, months later, nobody has to remember why invoices became staff-only or why the old backup was deleted.
Worked example
Leila changes the patient letters folder to staff-only that afternoon. She then asks Ben whether she must tell patients. Ben says this depends on what was exposed and for how long, and that she should gather evidence first and consult the clinic's data protection guidance, which chapter 2 covers.
Synthetic case. Leila, Ben, Oakfield and Westbrook are synthetic.
Errors and limits
Fixing the visible problem quickly is right, but the review must still look for similar problems elsewhere.
Exercises
- EX001 — Trigger. What made Leila notice the sharing problem? Rubric: 3 = patient's letter opened without login via forwarded link; 2 = partial; 1 = vague; 0 = none.
- EX002 — Services used. Name three cloud services Oakfield relies on. Rubric: 3 = storage, email, hosted booking platform; 2 = two; 1 = one; 0 = none.
- EX003 — Container inheritance. Why can an old base image affect the booking app? Rubric: 3 = app inherits its flaws; 2 = partial; 1 = vague; 0 = none.
- EX004 — Responsibility side. On which side of shared responsibility does the sharing mistake sit? Rubric: 3 = clinic's side; 2 = partial; 1 = vague; 0 = none.
- EX005 — First decisions. List Ben's three first decisions. Rubric: 3 = fix sharing, MFA, container update agreement; 2 = two; 1 = one; 0 = none.
- EX006 — Decision log. What does each decision log entry contain? Rubric: 3 = date, reason, owner; 2 = two; 1 = one; 0 = none.
- EX007 — Notification question. What did Ben advise about telling patients? Rubric: 3 = gather evidence, consult guidance; 2 = partial; 1 = vague; 0 = none.
- EX008 — Ownership of servers. Does Oakfield own any servers? Rubric: 3 = no; 2 = partial; 1 = vague; 0 = none.
- EX009 — Definition source. Which standard defines cloud computing used here? Rubric: 3 = NIST SP 800-145; 2 = partial; 1 = vague; 0 = none.
- EX010 — Clinic size effect. Why make proportionate rather than complete changes? Rubric: 3 = small clinic cannot do everything; 2 = partial; 1 = vague; 0 = none.
- EX011 — Visible fix limit. What must follow the quick fix? Rubric: 3 = look for similar problems; 2 = partial; 1 = vague; 0 = none.
- EX012 — Provider duty. What does the provider secure? Rubric: 3 = its infrastructure; 2 = partial; 1 = vague; 0 = none.
- EX013 — Folder change. What did Leila change on the first afternoon? Rubric: 3 = patient letters to staff-only; 2 = partial; 1 = vague; 0 = none.
Synthesis
Understand what the clinic controls and fix the most important things first.