Cloud security hub

Cloud Security: Labs, Architecture Guides, Checklists

Cloud security is how you protect data, applications and identities that run on cloud services. The core idea is the shared responsibility model: the provider secures the infrastructure it operates, and you secure what you put on it, which is mainly identity, data and configuration.

This page links every PlayCISO cloud security lab, checklist and architecture guide, by provider and by topic, with a starting path for beginners and for practitioners.

Updated 4 November 2026

What cloud security is, and who owns what

NIST's definition of cloud computing (SP 800-145) names three service models: software as a service (SaaS), platform as a service (PaaS) and infrastructure as a service (IaaS). Security responsibility moves with the model.

The three big providers describe the same split in their own words. AWS says security and compliance are shared: AWS operates and controls the components from the host operating system and virtualisation layer down to the physical facilities, and the customer is responsible for the guest operating system, application software and the configuration of the provider's security group firewall. Microsoft says workload responsibilities vary depending on whether the workload is SaaS, PaaS, IaaS or on-premises. Google frames it as shared responsibility and shared fate. Read each page for the current detail, because the lists change.

Model	You usually still own	Practise
IaaS (virtual machines, networks)	Guest OS, applications, network rules, identities, data	AWS Hardening Lab, CIS AWS benchmark checklist
PaaS (managed platforms)	Application, identities, data, configuration	Azure Hardening Lab, GCP Hardening Lab
SaaS (ready-made apps)	Identities, data, sharing and OAuth settings, usage	CASB Lab, What is CASB

Whatever the model, identity and data stay with the customer. That is why most of the labs below start with IAM, storage policy and logging.

By provider: lab, checklist and architecture guide

Provider	Labs	Checklist	Architecture guide
AWS	Hardening Lab, Account Compromise Lab	Security checklist	Secure architecture
Microsoft Azure	Hardening Lab, Identity Compromise Lab	Security checklist	Secure architecture
Google Cloud (GCP)	Hardening Lab, Incident Triage Lab	Security checklist	Secure architecture
Oracle Cloud (OCI)	Security Lab	Security checklist	Secure architecture
IBM Cloud	Security Lab	Security checklist	Secure architecture
Cloudflare	Security Lab	Security checklist	Secure architecture
Alibaba Cloud	Security Lab	Security checklist	Secure architecture
DigitalOcean	Security Lab	Security checklist	Secure architecture

Multi-cloud tools: Cloud Posture Lab, CSPM Triage Lab, CSPM readiness scorecard and the SOC cloud skills checklist.

By topic

Topic	Read	Practise
CASB and SaaS risk	What is CASB	CASB Lab
CSPM and posture	What is CSPM, CNAPP	CSPM Triage Lab, Cloud Posture Lab, CNAPP selector
AI security posture (AISPM)	What is AISPM, Local vs managed AI agents	AISPM Lab
Identity and access	Secure AWS architecture	IAM Privilege Escalation Lab, IAM Policy Analyzer, Azure Identity Compromise Lab
Storage exposure	Secure AWS architecture	S3 Bucket Policy Auditor
Logging and detection	How to triage a SOC alert	Cloud Logging Gap Checker, SOC cloud skills checklist
Incident response	Build an IR playbook	AWS Account Compromise Lab, Leaked Cloud Key Lab, GCP Incident Triage Lab
Containers and pipelines	Secure SDLC	Kubernetes Log Triage Lab, DevSecOps breach response checklist

Start here

If you are new to cloud security

Read the shared responsibility section above and What is CSPM.
Run the Cloud Posture Lab to see typical findings.
Pick one provider and score yourself with its security checklist, for example AWS or Azure.
Read the matching architecture guide, then do that provider's hardening lab.
Thinking about a career? See cloud security roles.

If you already run cloud security

Close identity gaps first: IAM Privilege Escalation Lab and IAM Policy Analyzer.
Check what you would be able to see in an incident with the Cloud Logging Gap Checker.
Rehearse a compromise on your main cloud: AWS, Azure or GCP.
Rank your tooling gaps with the CSPM readiness scorecard and CNAPP selector, then test SaaS and AI exposure in the CASB Lab and AISPM Lab.

Frequently asked questions

What is cloud security?

Cloud security is the set of controls, practices and responsibilities that protect data, applications and identities running on cloud services. It covers identity and access, network and storage policy, encryption and key management, logging and detection, configuration monitoring, and incident response. Which of those you run yourself depends on the service model you use.

What is the shared responsibility model?

It is the division of security tasks between the cloud provider and the customer. The provider secures the underlying infrastructure it operates; the customer secures what they put on it, such as identities, data and configuration. The split shifts with the service model: you own more with virtual machines (IaaS) than with a managed platform (PaaS) or a ready-made application (SaaS).

What are the types of cloud security?

Common groupings are identity and access management, data protection and encryption, network security, posture management (CSPM), workload protection, SaaS and shadow IT control (CASB), and monitoring with incident response. Newer additions include AI security posture management (AISPM). The by-topic section above links a page for each.

Where should a beginner start with cloud security?

Learn the shared responsibility model, then identity and storage policy on one provider, then logging. Use the beginner path on this page: the Cloud Posture Lab, one provider checklist, and the matching architecture guide.

Is the cloud less secure than on-premises?

There is no general answer. Providers operate and secure the lower layers, and customer misconfiguration of identity, storage and network policy is where many cloud incidents start. The result depends on how well your side of the shared responsibility line is run.

What is the difference between CSPM, CASB and CNAPP?

CSPM checks cloud configuration for risky settings. CASB controls SaaS use, such as shadow IT, OAuth grants and data loss. CNAPP is the broader platform category that bundles posture, workload protection and entitlement analysis. The CNAPP selector helps decide what to buy first.

Which cloud security labs does PlayCISO have?

Hardening, incident and checklist pages for AWS, Azure, Google Cloud, Oracle Cloud, IBM Cloud, Cloudflare, Alibaba Cloud and DigitalOcean, plus topic labs for CASB, CSPM, AISPM and IAM privilege escalation. The provider grid on this page lists each one.

What jobs use cloud security skills?

Cloud security engineer, architect, cloud SOC analyst, DevSecOps engineer, cloud compliance analyst, incident responder and penetration tester. The cloud security roles guide covers each, with pay from named sources and a 90-day learning path.