Lab 01 — Cloud Security

Welcome to your first practical lab in the ISC2 Labs section.

In this lab, you will apply the concepts covered across:

CISSP
CCSP
ISSAP
ISSEP
ISSMP

to assess the security posture of a cloud environment.

The objective is not to test one cloud platform.

Instead, you will practice a vendor-neutral enterprise cloud security assessment methodology that can be applied across:

AWS
Azure
Google Cloud
Private Cloud
Hybrid Cloud
Multi-Cloud

Mission Information

Mission: Perform a structured cloud security assessment.

Difficulty: Intermediate

Estimated Time: 60–90 minutes

Primary Skills:

Cloud security assessment
IAM review
Network security review
Data protection
Logging and monitoring
Workload security
Shared responsibility
Risk assessment
Security architecture
Incident readiness

Lab Scenario

You have joined an enterprise security team as a cloud security professional.

The organization is moving several workloads into the cloud.

Leadership wants to know:

Are our cloud environments secure?

Where are our biggest risks?

Which controls are missing?

What should we fix first?

You have been asked to conduct an initial security assessment.

Your assessment should evaluate:

Governance
    +
Identity
    +
Networking
    +
Workloads
    +
Data
    +
Logging
    +
Resilience
    +
Incident Readiness

Lab Objective

By the end of this lab, you should be able to:

Define cloud assessment scope
Identify critical cloud assets
Understand shared responsibility
Review cloud IAM
Review privileged access
Assess public exposure
Review network segmentation
Assess workload security
Review data protection
Review encryption and key management
Evaluate logging
Assess monitoring and detection
Review backup and recovery
Evaluate cloud incident readiness
Document cloud security findings
Prioritize risks
Produce an executive-level cloud security summary

Cloud Security Assessment Lifecycle

Use the following methodology:

01 Define Scope
      ↓
02 Understand Business Context
      ↓
03 Inventory Cloud Assets
      ↓
04 Determine Shared Responsibility
      ↓
05 Review Identity
      ↓
06 Review Network
      ↓
07 Review Workloads
      ↓
08 Review Data
      ↓
09 Review Logging and Monitoring
      ↓
10 Review Resilience
      ↓
11 Review Incident Readiness
      ↓
12 Identify Risks
      ↓
13 Prioritize Findings
      ↓
14 Produce Assessment Report

Phase 1 — Define Assessment Scope

Never begin an enterprise security assessment without clearly understanding the scope.

Document:

Cloud Environment

Accounts / Subscriptions / Projects

Applications

Regions

Networks

Data Stores

Users

Administrative Systems

Scope Example

Environment:
Production Cloud Environment

Applications:
Customer Portal

Cloud Resources:
20 Compute Workloads
3 Databases
5 Storage Services

Users:
150 Employees

Privileged Administrators:
8

Data:
Customer Information
Internal Business Data

Student Task

Create a scope table.

Area	Scope
Environment	Production
Applications	Customer application
Identity	Workforce and service identities
Network	Internet-facing and private networks
Data	Customer and business information
Logging	Administrative and workload logs

Why Scope Matters

Without proper scope:

Assessment
    ↓
Incomplete Visibility
    ↓
Missed Risk

You must know what you are responsible for reviewing.

Phase 2 — Understand the Business Context

Cloud security begins with the business.

Ask:

What does this environment support?

Which services are business-critical?

What data is processed?

What would happen if the system became unavailable?

What would happen if data were exposed?

Business Impact Categories

Consider:

Financial impact
Operational disruption
Regulatory impact
Customer impact
Reputation

Student Task

Identify at least three critical cloud assets.

Example:

Asset	Business Importance	Impact if Compromised
Customer database	Critical	Data exposure
Identity platform	Critical	Enterprise access compromise
Production application	High	Customer service outage

Phase 3 — Inventory Cloud Assets

You cannot secure what you do not know exists.

Identify:

Compute
Storage
Databases
Networks
IAM
Applications
Secrets
Keys
Logs
Backups

Cloud Asset Inventory

Example:

Resource	Type	Exposure	Owner	Criticality
Web Service	Application	Public	Application Team	High
Customer DB	Database	Private	Data Team	Critical
Admin Account	Identity	Management Plane	Cloud Team	Critical

Look for Unknown Resources

Common enterprise problems include:

Forgotten Resources
Unused Accounts
Old Snapshots
Legacy Systems
Development Workloads
Temporary Public Services

These resources may remain active long after their original purpose has ended.

Student Task

Create an inventory of at least ten hypothetical cloud resources.

For each document:

Resource Name
Type
Environment
Owner
Exposure
Data Sensitivity
Criticality

Phase 4 — Determine Shared Responsibility

Before assessing controls, determine who owns them.

Cloud security commonly operates under:

Cloud Provider
      +
Customer
      ↓
Shared Responsibility

IaaS Example

The provider may manage:

Physical Data Center
Hardware
Core Cloud Infrastructure

The customer may manage more of:

Operating Systems
Applications
IAM
Network Configuration
Data

PaaS Example

The provider may manage more of the operating platform.

The customer may still manage:

Application
Identity
Configuration
Data

SaaS Example

Customer responsibility may focus strongly on:

Identity
Configuration
Data
User Access
Governance

Student Task

Create a shared responsibility matrix.

Security Area	Provider	Customer	Shared
Physical infrastructure	✓
IAM configuration		✓
Data protection			✓
Application configuration		✓
Platform availability	✓		✓

Always validate the exact responsibility model for the actual service.

Why This Matters

A common cloud security failure is:

Customer Assumes Provider Owns Control
           +
Provider Assumes Customer Owns Control
           ↓
Control Gap

Phase 5 — Review Cloud Identity

Identity is one of the most important cloud security areas.

Assess:

Users
Groups
Roles
Service Accounts
Workload Identities
Privileged Access
Authentication
Access Reviews

Step 1 — Review Human Identities

Identify:

Employees
Contractors
Administrators
External users

Ask:

Does every account have an owner?

Are inactive users disabled?

Are leavers removed?

Are shared accounts used?

Step 2 — Review Authentication

For privileged users, review:

Password
     +
MFA

Higher-risk identities should receive stronger authentication.

Step 3 — Review Roles

Identify:

Basic roles
Administrative roles
Custom roles
Application roles

Look for excessive privilege.

Example

Poor:

Developer
   ↓
Full Cloud Administrator

Better:

Developer
   ↓
Application Deployment Role

Step 4 — Review Privileged Access

Ask:

Who has administrative access?

Why?

Is it permanent?

Is it reviewed?

Is activity logged?

Standing Privilege

Avoid where practical:

Permanent Administrator

Consider:

User
 ↓
Approved Elevation
 ↓
Temporary Administrative Access
 ↓
Privilege Removed

Step 5 — Review Service Identities

Applications and workloads often use:

Service accounts
Managed identities
Workload identities
API credentials

Ask:

Which workload uses this identity?

What permissions does it have?

Does it use long-lived credentials?

Are credentials rotated?

IAM Assessment Table

Identity	Type	Privilege	MFA	Review Required
Admin01	Human	High	Yes	Yes
App-Service	Workload	Medium	N/A	Yes
Old-Contractor	Human	Unknown	No	Immediate

Potential IAM Findings

Look for:

Excessive Privilege

Dormant Accounts

Missing MFA

Shared Administrative Accounts

Permanent Administrative Access

Unused Service Identities

Long-Lived Credentials

Phase 6 — Review Cloud Network Security

Next, assess network exposure.

Network Review Areas

Review:

Virtual Networks
Subnets
Routes
Firewalls
Security Rules
Public IPs
Private Connectivity
Hybrid Connections

Step 1 — Identify Internet-Facing Resources

Create a list of:

Public applications
Public IP addresses
Public APIs
Administrative interfaces

Ask:

Does this resource need to be public?

Public Exposure Review

For each public resource:

Resource	Public?	Business Need	Protection
Web Application	Yes	Customer access	WAF/Auth
Database	No	None	Private
Admin Portal	Review	Administration	Restricted access

Step 2 — Review Firewall Rules

Look for broad access such as:

Source:
Any

Destination:
Sensitive Resource

Action:
Allow

Ask whether more restrictive rules are possible.

Step 3 — Review Segmentation

Avoid:

Frontend
   ↔
Application
   ↔
Database
   ↔
Management
   ↔
Everything Else

Prefer controlled communication.

Internet
   ↓
Frontend
   ↓
Application
   ↓
Database

Step 4 — Review Administrative Access

Avoid direct public exposure of management interfaces.

Prefer:

Administrator
      ↓
Strong Authentication
      ↓
Controlled Management Path
      ↓
Target Resource

Step 5 — Review Egress

Outbound access matters.

A compromised workload may attempt:

Command and Control

Malware Download

Data Exfiltration

Review whether unrestricted outbound access is necessary.

Network Findings

Potential issues include:

Unnecessary public IP addresses
Broad firewall rules
Flat networks
Exposed administrative ports
Missing private connectivity
Unrestricted egress

Phase 7 — Review Workload Security

Cloud workloads may include:

Virtual Machines
Containers
Kubernetes
Serverless
Managed Platforms

Virtual Machine Review

Assess:

OS hardening
Patching
Endpoint security
IAM
Network exposure
Logging

Secure Baselines

A workload should start from an approved baseline.

Approved Image
      ↓
Secure Configuration
      ↓
Deploy
      ↓
Monitor

Patch Review

Document:

Workload	Patch Status	Critical Vulnerability	Action
Web01	Current	No	Monitor
API01	Outdated	Yes	Remediate
Legacy01	Unsupported	High Risk	Replace

Container Review

Assess:

Source
 ↓
Build
 ↓
Image
 ↓
Registry
 ↓
Runtime

Review:

Image origin
Vulnerabilities
Secrets
Registry access
Runtime privilege

Kubernetes Review

If Kubernetes is used, assess:

Cluster IAM
RBAC
Service accounts
Secrets
Network policies
Admission controls
Logging

Serverless Review

Review:

Function IAM
Secrets
External triggers
API exposure
Logging

Serverless reduces infrastructure responsibility but does not eliminate application and identity risk.

Phase 8 — Review Cloud Data Security

Identify:

What Data Exists?

Where?

How Sensitive?

Who Can Access It?

How Is It Protected?

Data Classification

Create:

Data	Classification	Owner	Location
Public website	Public	Marketing	Web storage
Employee records	Confidential	HR	Database
Customer credentials	Restricted	Security/Application	Identity service

Review Data States

Assess:

Data at Rest
Data in Transit
Data in Use

Encryption at Rest

Review:

Databases
Disks
Object storage
Backups

Encryption in Transit

Review communication between:

User → Application

Application → API

API → Database

Cloud → On-Premises

Key Management

Ask:

Who owns keys?

Who can use them?

Who can administer them?

Are they rotated?

Are key actions logged?

Storage Access

Review:

Public Access

Anonymous Access

Cross-Account Access

Privileged Access

Data Retention

Ask:

How long is data retained?

Why?

What happens after retention ends?

Backup Copies

Remember that backups may contain the same sensitive data as production.

They require equivalent protection.

Potential Data Findings

Examples:

Public object storage
Excessive database access
Missing encryption
Weak key permissions
Excessive retention
Unprotected backups

Phase 9 — Review Logging and Monitoring

A cloud environment should provide enough evidence to answer:

Who did what?

When?

From where?

Against which resource?

What was the result?

Important Log Sources

Look for:

Authentication Logs

Administrative Activity

IAM Changes

Network Logs

Workload Logs

Application Logs

Data Access Logs

Administrative Logging

Ensure critical control-plane actions are captured.

Examples:

New administrator created
IAM policy changed
Firewall rule modified
Logging disabled
Key deleted

Centralized Logging

A mature design may use:

Cloud Environment A ─┐
Cloud Environment B ─┤
Cloud Environment C ─┼──→ Central Security Logging
Applications ────────┤
Identity ────────────┘

Log Protection

Ask:

Can administrators delete logs?

Who can modify logging configuration?

How long are logs retained?

Are security teams able to access them?

Detection Review

Look for detections covering high-risk events.

Examples:

Privileged Role Assignment

New Public Resource

MFA Disabled

Logging Disabled

Unusual Authentication

Security Rule Changed

Detection Gap

A serious problem is:

Activity Is Logged
      ↓
But Nobody Monitors It

Logging and detection are different capabilities.

Phase 10 — Review Resilience

Cloud does not automatically guarantee business continuity.

Review:

High availability
Backups
Recovery
Regional dependencies
Critical service dependencies

Identify Single Points of Failure

Example:

Customer Application
      ↓
Single Database
      ↓
Failure
      ↓
Complete Outage

Review RTO

Ask:

How quickly must the system recover?

Review RPO

Ask:

How much data loss is acceptable?

Backup Review

Validate:

Backup Exists
      +
Backup Protected
      +
Backup Restore Tested

A backup that cannot be restored provides little assurance.

Recovery Security

Ask:

Can a compromised administrator
delete production and backups?

If yes, resilience may be weak.

Phase 11 — Review Incident Readiness

Cloud incident response should be planned before an incident occurs.

Incident Readiness Questions

Ask:

Who receives cloud alerts?

Who can disable compromised identities?

Who can isolate workloads?

How are logs preserved?

Who communicates with the provider?

Where are incident runbooks?

Example Cloud Incident

Scenario:

Privileged Identity Compromised
        ↓
IAM Role Changed
        ↓
Public Storage Created
        ↓
Sensitive Data Accessed

Investigation Workflow

Alert
  ↓
Identify Principal
  ↓
Review Authentication
  ↓
Review Administrative Actions
  ↓
Identify Affected Resources
  ↓
Determine Blast Radius
  ↓
Preserve Evidence
  ↓
Contain

Containment Options

Depending on the situation:

Disable compromised credentials
Remove excessive permissions
Isolate workloads
Block network access
Revoke sessions

Evidence

Possible evidence includes:

Cloud Audit Logs
Authentication Logs
Network Logs
Snapshots
Configuration History
Application Logs

Phase 12 — Identify Security Findings

A finding should clearly describe:

What Is Wrong?

Why Does It Matter?

What Evidence Exists?

How Should It Be Fixed?

Cloud Security Finding Template

Finding:
[Cloud security weakness]

Affected Resource:
[Account / workload / service]

Risk:
[Potential business and technical impact]

Evidence:
[Validated observation]

Recommendation:
[Remediation]

Priority:
[Critical / High / Medium / Low]

Example Finding 1

Finding:
Excessive Privileged Access

Affected Resource:
Production Cloud Environment

Risk:
Compromise of a standing administrative account
could provide broad control over production resources.

Evidence:
Eight users maintain permanent administrator roles.

Recommendation:
Review administrative requirements,
remove unnecessary privileges,
implement stronger privileged access governance,
and use temporary elevation where appropriate.

Priority:
High

Example Finding 2

Finding:
Publicly Accessible Database

Affected Resource:
Customer Database

Risk:
Internet exposure increases the attack surface
of a system storing sensitive customer information.

Evidence:
Database endpoint accepts public network traffic.

Recommendation:
Remove unnecessary public access and require
controlled private connectivity.

Priority:
Critical

Example Finding 3

Finding:
Insufficient Administrative Logging

Affected Resource:
Cloud Management Plane

Risk:
Security teams may be unable to investigate
privileged changes or detect unauthorized activity.

Evidence:
Administrative activity logs are not centrally retained.

Recommendation:
Enable required audit logging,
centralize logs,
protect retention,
and implement security monitoring.

Priority:
High

Phase 13 — Prioritize Findings

Do not prioritize only by technical severity.

Consider:

Exposure
   +
Exploitability
   +
Asset Criticality
   +
Business Impact
   +
Existing Controls

Example Prioritization

Finding	Severity	Business Impact	Priority
Public customer database	Critical	Critical	Immediate
Missing admin MFA	High	Critical	Immediate
Excessive IAM	High	High	High
Missing network logs	Medium	High	High
Old unused test resource	Low	Low	Low

Remediation Categories

Organize recommendations into:

Immediate

Short Term

Medium Term

Strategic

Immediate

Examples:

Remove public database access
Disable compromised accounts
Protect critical administrative access

Short Term

Examples:

Review IAM roles
Enable logging
Harden network controls

Medium Term

Examples:

Implement centralized privileged access
Improve detection
Standardize secure baselines

Strategic

Examples:

Cloud governance program
Zero Trust
Automated policy enforcement
Multi-cloud security architecture

Phase 14 — Create the Cloud Security Assessment Report

Your final deliverable should contain:

01 Executive Summary

02 Scope

03 Business Context

04 Cloud Architecture Overview

05 Identity Findings

06 Network Findings

07 Workload Findings

08 Data Findings

09 Logging Findings

10 Resilience Findings

11 Incident Readiness

12 Risk Summary

13 Recommendations

14 Remediation Roadmap

Executive Summary Template

Assessment Objective:

Evaluate the security posture of the organization's
cloud environment.

Overall Risk:

[Low / Moderate / High / Critical]

Key Findings:

1. [Finding]
2. [Finding]
3. [Finding]

Business Impact:

[Short business-focused explanation]

Priority Actions:

1. [Immediate action]
2. [Immediate action]
3. [Immediate action]

Cloud Security Assessment Scorecard

Create a simple scorecard.

Security Domain	Rating
Governance	Moderate
IAM	High Risk
Network	Moderate
Workloads	Moderate
Data	High Risk
Logging	Moderate
Resilience	Moderate
Incident Readiness	High Risk

Avoid using the score as a substitute for professional judgment.

Architecture View

Create a simplified architecture diagram.

                   Internet
                      ↓
                 Web Application
                      ↓
                Application Tier
                      ↓
                   Database
                      ↓
                    Backup

Identity ─────────────────────────┐
                                 │
Logging ──────────────────────────┼──→ Security Monitoring
                                 │
Cloud Management ────────────────┘

Mark:

Public Exposure

Trust Boundaries

Sensitive Data

Administrative Paths

Logging Points

Risk-Based Cloud Review Framework

Use this quick framework in future assessments:

G — Governance
I — Identity
N — Network
W — Workloads
D — Data
L — Logging
R — Resilience
I — Incident Response

Think:

GINWDLRI

The exact acronym is less important than consistently reviewing all major security layers.

Security Professional Questions

During every cloud assessment ask:

What are we protecting?

Who can access it?

Why can they access it?

How is it exposed?

Where is the data?

What happens if credentials are compromised?

What logs would prove what happened?

How would we contain an incident?

How would the business recover?

Lab Deliverables

By the end of this lab, you should produce:

Career Connection

This type of assessment is directly relevant to roles such as:

Cloud Security Engineer

Cloud Security Architect

Security Consultant

Enterprise Security Architect

Security Manager

Cloud Risk Consultant

It trains you to move beyond isolated technical configuration and evaluate security as an enterprise system.

Interview Questions After This Lab

You should now be able to answer:

How would you begin a cloud security assessment?
Why is asset inventory important?
What is shared responsibility?
How does responsibility differ across IaaS, PaaS, and SaaS?
What should you review in cloud IAM?
Why is standing privilege risky?
What are service identities?
How would you identify excessive permissions?
How would you assess cloud network exposure?
Why is segmentation important?
Why should egress traffic be reviewed?
How would you assess virtual machine security?
What should you review in container environments?
What are important Kubernetes security areas?
How would you assess cloud data protection?
Why is data classification important?
What should you review in encryption key management?
Which cloud logs are important?
What is the difference between logging and detection?
How would you protect security logs?
How would you assess cloud resilience?
Why are RTO and RPO important?
What makes a backup trustworthy?
How would you prepare for cloud incident response?
Which evidence sources would you use during an investigation?
How would you prioritize cloud security findings?
What should an executive cloud security report contain?
How would you translate a technical cloud issue into business risk?
What are common cloud security misconfigurations?
How would you build a cloud security remediation roadmap?

Lab Completion Milestone

After completing this lab, you should be able to approach a cloud environment systematically:

Understand
   ↓
Inventory
   ↓
Assess
   ↓
Validate
   ↓
Identify Risk
   ↓
Prioritize
   ↓
Recommend
   ↓
Report

The key professional transition is:

Looking at Individual Cloud Settings

toward:

Assessing the Entire Cloud Security Posture

That is the mindset expected from an enterprise cloud security professional.

What’s Next?

➡️ Lab 02 — IAM

In the next lab, you will focus specifically on Identity and Access Management security.

You will assess:

Users
 ↓
Groups
 ↓
Roles
 ↓
Privileges
 ↓
Service Identities
 ↓
Authentication
 ↓
Access Reviews
 ↓
Privileged Access

The progression is:

Cloud Security Assessment
        ↓
Identify Identity as a Critical Control Plane
        ↓
IAM Security Assessment