Wednesday, April 29, 2026

Cohort 3 | Project CloudIgnite Topics: Security Threats, Cloud Security Strategy, Shared Responsibility Model, Security Controls, Network Hardening, IAM Duration: ~3 hours

🎯 CLF-C02 Relevance: This lecture maps heavily to the Security & Compliance domain (Domain 2) of the AWS Certified Cloud Practitioner exam, which accounts for 30% of the exam score. Sections marked with ☁️ are directly examinable.

Key Takeaways

• AWS Shared Responsibility Model: AWS = "Security OF the cloud"; Customer = "Security IN the cloud"
• Threats: malware (virus/worm/trojan/ransomware), DDoS, phishing, MitM, social engineering
• Security lifecycle: Prevention → Detection → Response → Analyze
• Prevention phase: identify assets (nmap, Systems Manager), assess vulnerabilities (CVE), implement countermeasures
• Network hardening: default-deny firewall, close unused ports, network segmentation with public/private subnets
• Layered security: Perimeter → Network → Endpoint → Application → Data (each layer uses different methods)
• IAM: Principle of least privilege — grant only minimum permissions needed

Table of Contents

1. Bash Challenge (Warm-up)
2. Types of Security Threats
3. Cloud Security Strategy
4. AWS Shared Responsibility Model
5. Security Controls
6. Security Lifecycle
7. Prevention Phase – In Depth
8. Network Hardening
9. System Hardening
10. Data Security Controls
11. Identity & Access Management
12. Layered Security Model
13. Network Tools Demo
14. Quiz & Knowledge Check Answers

Bash Challenge

#!/bin/bash
read -p "Enter filename: " file
if [ ! -f "$file" ]; then
  echo "File not found"
  exit 1
fi
lines=$(wc -l < "$file")
if [ "$lines" -gt 10 ]; then
  echo "Large file"
else
  echo "Small file"
fi

Explanation: The script prompts for a filename, checks if it exists, counts its lines, and prints whether it's a "Large file" (>10 lines) or "Small file".

Types of Security Threats

Malware (Malicious Software)

Malware is any software designed to disrupt operations, gain unauthorized access, or collect/modify sensitive information.

Other Threat Types

Cloud Security Strategy

A security strategy answers three core questions:

1. What to protect? (identify resources: EC2, VPC, S3, RDS, etc.)
2. When to protect? (security lifecycle – when is the resource running/exposed?)
3. Who is responsible? (shared responsibility model)

AWS Shared Responsibility Model ☁️

This is a heavily tested CLF-C02 topic.

Customer Responsibility ("Security IN the Cloud")

• Customer data
• Application code and installed software
• IAM (users, roles, policies)
• OS, network, and firewall configuration on EC2
• Client-side and server-side encryption (if using own keys)
• Network traffic protection (security group / NACL configuration)

AWS Responsibility ("Security OF the Cloud")

• Physical infrastructure (data centres, hardware, cabling)
• Compute, storage, database, and networking infrastructure
• Hypervisor and virtualisation layer
• Managed services' underlying OS and patching

Shared Responsibility

• DDoS mitigation (partly AWS tools like AWS Shield, partly your application design)
• Administrative controls (IAM user management)

Security Controls

Three types of security controls:

Controls are also categorised as:

• Physical – Mostly AWS's responsibility (data centre security)
• Technical – Antivirus, firewalls, encryption
• Administrative – IAM policies, acceptable use policies (shared)

Security Lifecycle ☁️

A continuous loop with four phases:

Prevention → Detection → Response → Analyze → (back to Prevention)

💡 Exam tip: Security countermeasures are implemented in the Prevention phase.

Prevention Phase – In Depth

Step 1 – Identify Assets to Protect

• Network devices – routers, physical connections
• Servers – EC2 instances
• Applications & Services – e.g., Apache HTTPD running as a background service

Tools for asset discovery:

Step 2 – Assess Vulnerabilities

• Network assessment – which ports are open? which devices are public-facing?
• Host assessment – are OS security patches up to date?
• Application assessment – are libraries/dependencies free of known CVEs? (e.g., Axios vulnerability example)
• Data assessment – is data encrypted in transit (HTTPS) and at rest?

🔗 Resource: Common Vulnerabilities and Exposures (CVE)

Step 3 – Implement Countermeasures

• Apply the correct fix based on the CVE description
• Upgrade or downgrade affected software versions as needed (e.g., Apache Log4j2)

Network Hardening

Network Discovery Hardening

• Block network exploration protocols – prevent attackers from mapping your topology
• Close all unused ports – only open ports that are actively needed (e.g., 22, 80, 443)
• Keep all software up to date

Network Architecture Hardening ☁️

Security Group vs NACL:

• Security Group – denies all by default; stateful; applied at instance level
• NACL – allows all by default; stateless; applied at subnet level; must explicitly deny if needed

Firewall Best Practice:

Deny ALL traffic by default → explicitly allow only what is needed

Key ports to know:

System Hardening

Focus area: the Operating System and installed software.

1. Apply all security patches and updates promptly
2. Remove unused applications – reduce attack surface
3. Monitor configuration changes continuously

⚠️ "Outdated OS" doesn't mean the previous version – it means a version whose vendor support has ended (no more security patches). Always check the OS maintenance lifecycle.

Data Security Controls

• Ensure data is encrypted in transit → use HTTPS / TLS certificates
• Ensure data is encrypted at rest → enable server-side encryption (S3, EBS, RDS)
• Verify data integrity → use digital certificates (SSL/TLS)
• If you are using your own encryption keys, their security is your responsibility, not AWS's

💡 Never enter sensitive information (passwords, credit card details) on a site that uses plain HTTP.

Identity & Access Management ☁️

Core CLF-C02 topic.

Principle of Least Privilege:

Grant a user access to only the resources they are authorised to use – nothing more.

Best practices:

• Deny all access by default; grant permissions granularly
• Enforce strong password policies via IAM password policy
• Enable Multi-Factor Authentication (MFA) for all privileged accounts
• Regularly audit and remove unnecessary permissions
• AWS IAM is conceptually similar to Linux users and groups

Layered Security Model

Inspired by defence-in-depth (like castle walls: moat → outer wall → inner wall → keep).

Perimeter Security  →  Network Security  →  Endpoint Security
    →  Application Security  →  Data Security

Why layered security?
If one layer is breached, the next layer provides protection. Each layer uses different methods – repeating the same method at every layer provides no real benefit.

OSI model analogy: security can be implemented at every layer (L1–L7); if L7 is breached, L6 provides a backstop.

Network Tools Demo

nmap – Network Scanner

# Install
sudo apt install nmap

# Scan specific ports on a target
nmap -p 21,22,80,443,8080 <target-ip>

# Scan all hosts on a subnet
nmap 192.168.100.0/24

# Scan without DNS resolution
nmap -n 192.168.100.0/23

Output shows: host IP, MAC address, open/filtered/closed ports per host.

telnet – Quick Port Check

telnet <ip-address> <port>
# "Connected" = port is open
# Connection refused / timeout = port is closed/filtered

Wireshark – Packet Sniffer

• Captures all packets travelling over a network interface
• Shows: source IP, destination IP, protocol (TCP/UDP), packet length, raw data (hex)
• Filtered port = accessible from specific IP ranges only, not the public internet
• If traffic is unencrypted (HTTP), packet contents are fully readable
• If traffic is encrypted (HTTPS), captured packets show only ciphertext

⚠️ Public Wi-Fi warning: Anyone on the same network can run nmap to discover your device and Wireshark to sniff your unencrypted traffic. Use a VPN on public Wi-Fi.

Amazon Inspector ☁️

• AWS-native tool that automatically assesses your EC2 instances and network
• Reports on: open unused ports, outdated/vulnerable software versions, missing patches
• Produces a prioritised findings report so you can remediate issues

Quiz & Knowledge Check Answers

📌 CLF-C02 Exam Relevance Summary

The following topics from this lecture are directly relevant to the AWS Certified Cloud Practitioner (CLF-C02) exam:

📚 Recommended next step: Review the AWS Shared Responsibility Model and practice IAM policy scenarios.

Notes compiled from lecture – April 29, 2026. Some content lightly paraphrased for clarity.