Cloud security and Compliance

The session opens with the concerns organizations raise about moving to the cloud. The speaker cites a 2021 industry survey of security professionals, in which data leakage, privacy and accidental credential exposure ranked as the top worries, and misconfiguration was described as a persistent problem. Cloud risk is framed as largely similar to on-premises risk, with shadow IT, privileged access and governance gaps singled out as areas that need attention.

The middle of the talk looks at reference models from the Cloud Security Alliance and the difference between IaaS, PaaS and SaaS, since that split determines who controls what. The AWS shared responsibility model is the central example: the customer stays accountable for its data, identities, operating systems and configuration, while the provider covers the underlying infrastructure. The speaker explains SOC 1 and SOC 2 reports, the trust service criteria, and how ISO 27001 and related cloud standards map to controls. A tour of AWS security services, including identity management, logging, monitoring and configuration auditing, is organized around identify, protect and detect.

The closing discussion covers developers who hard-coded long-lived access keys and resisted rotating them. The suggested approach is to tie the change to a compliance requirement, invest in training, and assign a clear business owner to each application so accountability is not left unassigned.