Cloud Security and Access Control

Focus: Protecting data and users in multi-tenant environments.

Key Notes

• Shared Responsibility Model:
  • Provider → Infrastructure security.
  • User → Account and data security.
• Access Controls:
  • Role-Based Access Control (RBAC) — permissions by role.
  • Multi-Factor Authentication (MFA).
  • Encryption in transit (HTTPS, TLS) and at rest (AES 256).
• Audit Logs: record sign-ins, resource changes, policy edits.
• Incident Response: identify → contain → eradicate → recover → review.

Mini-Case

“A former contractor still has access to a shared Drive folder.”

Discuss steps to revoke access and document the fix.

Discussion

How does cloud security rely on people as much as technology?