Mini Enterprise Scenario

Learning Path

📘 Phase 1 – Overview

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Apply everything learned in Phase 1.
Think like a Cloud Security Engineer.
Analyse an enterprise cloud environment.
Identify security risks.
Recommend AWS security services.
Present security recommendations to business stakeholders.
Experience a realistic enterprise security assessment.

📚 Lesson Information

Estimated Time: 3–4 Hours

Difficulty: Beginner to Intermediate

Prerequisites: Complete Phase 1

Hands-on Lab: Yes (Enterprise Simulation)

Assignment: Yes

🎉 Welcome to Your First Enterprise Project

Congratulations!

You have completed the foundational lessons required for becoming a Cloud Security Engineer.

Now it’s time to stop learning individual concepts and start applying them together.

For the first time, you will act as the Cloud Security Engineer at CloudNova Technologies.

There are no step-by-step instructions.

Like a real engineer, you must investigate, analyse, prioritise, communicate and recommend solutions.

🏢 About CloudNova Technologies

CloudNova Technologies is a growing SaaS company serving customers across multiple countries.

The company provides:

Customer Portal
Internal HR Portal
Payment Processing
File Storage Platform
Analytics Dashboard

AWS Environment:

4 AWS Accounts
2 Production Regions
Amazon EC2
Amazon EKS
Amazon RDS
Amazon S3
Lambda
CloudFront
Route53

Employees:

Customers:

120,000+

📢 Monday Morning

It is 09:00 AM.

Today is your first official day as a Cloud Security Engineer.

You receive the following email.

📧 Email from the CISO

Subject: Immediate Security Assessment Required

Welcome to CloudNova Technologies.

We are preparing for a security audit next month.

During our internal review we identified several potential security concerns.

Your responsibility is to review the AWS environment, identify security risks and recommend improvements.

Please provide a report before the end of today.

Good luck.

Sarah Williams

Chief Information Security Officer

☁️ Current AWS Environment

The environment currently looks like this.

                     Internet
                          │
                          ▼
                  Application Load Balancer
                          │
             ┌────────────┴────────────┐
             │                         │
        EC2 Web Server           EC2 Web Server
             │                         │
             └────────────┬────────────┘
                          ▼
                  Amazon RDS Database
                          │
                          ▼
                    Amazon S3 Storage

Everything appears operational.

But is it secure?

🔍 Security Assessment Findings

After reviewing the environment, you discover the following.

Identity

❌ Root account has no MFA.

❌ AdministratorAccess assigned to every engineer.

❌ Shared AWS Administrator account.

❌ Access keys older than 600 days.

❌ No password rotation.

Network

❌ SSH open to:

0.0.0.0/0

❌ Database accessible from the internet.

❌ No VPN.

❌ Flat network.

❌ No Network Firewall.

Storage

❌ Public S3 bucket.

❌ Versioning disabled.

❌ Encryption disabled.

❌ Public customer invoices.

Compute

❌ EC2 instances missing patches.

❌ Default Security Groups.

❌ No hardened AMIs.

❌ No vulnerability scanning.

Monitoring

❌ GuardDuty disabled.

❌ Security Hub disabled.

❌ CloudTrail logging disabled.

❌ AWS Config disabled.

Backup

❌ No backup policy.

❌ Recovery procedures never tested.

Compliance

❌ No documentation.

❌ No risk register.

❌ No architecture review.

🚨 Unexpected Event

At 11:15 AM, a GuardDuty trial account (enabled temporarily) reports:

Unauthorized IAM Access

Severity: HIGH

CloudTrail indicates:

Login from another country.
Thousands of S3 objects downloaded.
AdministratorAccess used.
Access key created.
IAM Policy modified.

You now have an active security incident.

🎯 Your Mission

You are now responsible for protecting CloudNova Technologies.

Complete the following tasks.

Task 1 — Identify Assets

List every critical business asset.

Examples:

Customer Data
IAM Users
EC2
Databases
APIs
Source Code
Encryption Keys

Task 2 — Identify Threats

Examples:

Phishing
Insider Threat
Malware
Ransomware
DDoS
Credential Theft
Data Exfiltration

Task 3 — Identify Vulnerabilities

Review every weakness.

Examples:

Missing MFA
Public Database
Shared Administrator Account
Open SSH
Public S3 Bucket

Task 4 — Prioritise Risks

Complete the following matrix.

Finding	Likelihood	Impact	Priority
Root without MFA
Public S3 Bucket
Disabled CloudTrail
Shared Admin Account
Public Database

Explain your decisions.

Task 5 — Incident Response

Respond to the GuardDuty alert.

Describe the actions you would take.

Think about:

Containment
Investigation
Evidence Collection
Recovery
Communication

Task 6 — AWS Services

Which AWS services would you recommend?

Examples:

IAM
GuardDuty
Security Hub
CloudTrail
Config
KMS
WAF
Shield
Backup
Inspector

Explain why each service is required.

Task 7 — Enterprise Security Architecture

Design a secure architecture.

Include:

Public Subnets
Private Subnets
Load Balancer
WAF
Shield
EC2
Auto Scaling
RDS
KMS
Security Groups
NAT Gateway
CloudTrail
GuardDuty
Security Hub

Draw your architecture using:

draw.io
Lucidchart
Excalidraw
Visio

Task 8 — Executive Summary

Write a one-page report for the CISO.

Include:

Current security posture.
Highest risks.
Immediate actions.
Long-term improvements.
Expected business benefits.

Remember:

The CISO is interested in business risk, not technical jargon.

🧪 Enterprise Simulation Lab

Phase 1 — Morning Review

Review the findings.

Prioritise:

Critical
High
Medium
Low

Phase 2 — Security Investigation

Analyse:

CloudTrail
GuardDuty
IAM
Security Groups

Document your findings.

Phase 3 — Architecture Review

Redesign the AWS environment.

Explain every security improvement.

Phase 4 — Incident Response

Write an incident timeline.

Example:

Time	Event
09:10	Login
09:12	IAM Policy Changed
09:14	Access Key Created
09:16	S3 Download Started
09:20	GuardDuty Alert

Phase 5 — Executive Presentation

Prepare a 10-minute presentation.

Audience:

CISO
CTO
Engineering Manager

Present:

Risks
Business Impact
Recommendations
Roadmap

📊 Knowledge Check

Answer the following questions:

Which issue presents the highest business risk?
Why is the shared administrator account dangerous?
Why should CloudTrail always be enabled?
Why should customer data never be stored in a public S3 bucket?
Why is MFA mandatory for privileged accounts?
Which AWS services improve monitoring?
Which AWS services improve network security?
Which AWS services improve data protection?
Which recommendations should be implemented immediately?
If you had only one week to improve security, where would you start and why?

📝 Final Assignment

You have been hired as the Cloud Security Engineer for CloudNova Technologies.

Prepare a professional Cloud Security Assessment Report.

Include:

Executive Summary
Current Architecture Review
Asset Inventory
Threat Assessment
Vulnerability Assessment
Risk Matrix
AWS Security Recommendations
Enterprise Architecture Diagram
Incident Response Plan
Risk Treatment Plan
Security Roadmap (30 / 60 / 90 Days)
Lessons Learned

Length: 8–12 pages.

🎓 Phase 1 Capstone Deliverables

By the end of this lesson, you should produce:

✅ Security Assessment Report
✅ Enterprise Architecture Diagram
✅ Risk Register
✅ Incident Timeline
✅ Executive Summary
✅ Security Roadmap
✅ Presentation Slides (Optional)
✅ Recommendations for CloudNova Technologies

These are the same types of deliverables Cloud Security Engineers create in real enterprise environments.

💡 Key Takeaways

After completing this capstone, you should be able to:

Analyse a cloud environment from a security perspective.
Identify assets, threats, vulnerabilities and risks.
Apply networking, IAM, encryption and security architecture concepts together.
Recommend AWS security services based on business needs.
Respond to a simulated security incident.
Communicate technical findings to business stakeholders.
Think and act like a Cloud Security Engineer in an enterprise environment.

🏆 Congratulations!

You have completed Phase 1 – Overview.

You now understand the foundational concepts required to begin securing AWS environments.

In the next phase, you will move from theory into hands-on implementation, where you will configure IAM, secure VPCs, implement encryption, deploy monitoring services, and build production-ready cloud security architectures.

📚 Further Reading

AWS Well-Architected Framework – Security Pillar
AWS Security Reference Architecture (SRA)
AWS Prescriptive Guidance – Security
CIS AWS Foundations Benchmark
NIST Cybersecurity Framework (CSF) 2.0
MITRE ATT&CK Framework

🚀 Next Phase

➡️ Phase 2 — AWS Cloud Security