Cloud Security: Security in AWS, Azure and GCP - The complete guide
Cloud Security guide: Shared Responsibility Model, common misconfigurations, CSPM, IAM, encryption - for AWS, Azure and GCP.
Summary: Cloud security addresses the shared responsibility model: Cloud providers secure the infrastructure, while customers secure their data, configurations, identities, and applications. Most common vulnerabilities: misconfigurations (public S3 buckets, permissive security groups), excessive IAM permissions, lack of encryption, no MFA for root. CSPM tools (Defender for Cloud, AWS Security Hub, Wiz) detect deviations. CSMA, CWPP, and CIEM as security categories.
Sources & References
- [1] NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing - NIST
- [2] CSA Cloud Controls Matrix (CCM) - Cloud Security Alliance
- [3] AWS Shared Responsibility Model - Amazon Web Services
- [4] BSI: Cloud Computing Eckpunktepapier - BSI
- [5] CIS Cloud Benchmarks - CIS
Questions about this topic?
Our experts advise you free of charge and without obligation.
About the Author
Managing Director of AWARE7 GmbH with many years of expertise in information security, penetration testing and IT risk management. Graduate of the Internet Security master's program at Westfälische Hochschule (if(is), Prof. Norbert Pohlmann). Bestselling author with Wiley-VCH and lecturer at the ASW-Akademie. His assessments of cybersecurity and digital sovereignty have appeared in Welt am Sonntag, WDR, Deutschlandfunk and Handelsblatt, among others.
10 Publikationen
- Einsatz von elektronischer Verschlüsselung - Hemmnisse für die Wirtschaft (2018)
- Kompass IT-Verschlüsselung - Orientierungshilfen für KMU (2018)
- IT Security Day 2025 - Live Hacking: KI in der Cybersicherheit (2025)
- Live Hacking - Credential Stuffing: Finanzrisiken jenseits Ransomware (2025)
- Keynote: Live Hacking Show - Ein Blick in die Welt der Cyberkriminalität (2025)
- Analyse von Angriffsflächen bei Shared-Hosting-Anbietern (2024)
- Gänsehaut garantiert: Die schaurigsten Funde aus dem Leben eines Pentesters (2022)
- IT Security Zertifizierungen - CISSP, T.I.S.P. & Co (Live-Webinar) (2023)
- Sicherheitsforum Online-Banking - Live Hacking (2021)
- Nipster im Netz und das Ende der Kreidezeit (2017)
