Computer Science · 12th Grade · Network Architecture and Cryptography · Weeks 28-36

Cloud Computing Security

Students explore the security challenges and solutions associated with cloud computing environments.

• Common Core State Standards
• CSTA: 3B-NI-04
• CCSS.ELA-LITERACY.RST.11-12.7

About This Topic

Cloud computing has become the dominant infrastructure model for software development and deployment, and 12th graders entering tech careers will work with it from day one. This topic focuses on the security implications of moving computing resources off physical premises and into shared, multi-tenant environments managed by providers like AWS, Google Cloud, and Microsoft Azure. The central framework students must understand is the shared responsibility model: cloud providers secure the underlying infrastructure (physical data centers, hypervisors, network hardware), while customers are responsible for securing the data, applications, and access controls they place on top of that infrastructure.

Students should be able to distinguish between the three primary service models and how responsibility shifts between them. In Infrastructure as a Service (IaaS), customers manage the operating system and everything above it. In Platform as a Service (PaaS), the provider manages the runtime and middleware, reducing customer responsibility but also reducing control. In Software as a Service (SaaS), the provider manages nearly everything, but customers must still manage user access and data governance.

Active learning suits this topic well because security decisions in the cloud are inherently contextual and trade-off-laden. Scenario-based design challenges give students practice applying abstract principles to realistic decisions they will face as developers and system designers.

Key Questions

1. Analyze the shared responsibility model in cloud security.
2. Differentiate between various cloud deployment models (IaaS, PaaS, SaaS) and their security implications.
3. Design a basic security strategy for migrating an application to the cloud.

Learning Objectives

• Analyze the division of security responsibilities between cloud providers and customers within the shared responsibility model.
• Compare the security implications and customer management overhead for IaaS, PaaS, and SaaS cloud deployment models.
• Design a foundational security strategy, including access control and data protection measures, for migrating a web application to a chosen cloud platform.
• Evaluate potential security threats, such as misconfigurations and unauthorized access, specific to cloud environments.
• Explain the role of encryption and identity management in securing data and resources in the cloud.

Before You Start

Network Fundamentals

Why: Students need a basic understanding of network protocols, IP addressing, and firewalls to grasp how these concepts apply in cloud environments.

Introduction to Cybersecurity Concepts

Why: Prior knowledge of common threats, vulnerabilities, and basic security principles is essential for understanding cloud-specific security challenges.

Basic Cryptography

Why: Understanding encryption, hashing, and digital signatures is foundational for discussing data protection in the cloud.

Key Vocabulary

Shared Responsibility Model	A cloud security framework outlining which security tasks are handled by the cloud provider and which are the customer's responsibility.
IaaS (Infrastructure as a Service)	A cloud service model where the provider offers virtualized computing resources over the internet, with the customer managing operating systems, middleware, and applications.
PaaS (Platform as a Service)	A cloud service model where the provider manages the underlying infrastructure and operating system, allowing customers to focus on developing and deploying applications.
SaaS (Software as a Service)	A cloud service model where the provider delivers software applications over the internet on a subscription basis, managing all aspects of the infrastructure and software.
Cloud Misconfiguration	Errors in setting up cloud security controls, such as open storage buckets or overly permissive access policies, which can lead to data breaches.

Watch Out for These Misconceptions

Common Misconception

The cloud provider is responsible for all security once you move to the cloud.

What to Teach Instead

Providers secure the infrastructure, but customers remain responsible for their data, application configuration, and access controls. Most major cloud breaches involve customer misconfiguration, not provider failures. The shared responsibility model activity makes clear exactly where that line sits for each service type.

Common Misconception

Data in the cloud is inherently less secure than data stored on-premises.

What to Teach Instead

Large cloud providers invest heavily in physical security, redundancy, and patch management that few organizations can match on-premises. The real question is whether the customer has correctly configured their security controls. Poor configuration of an on-premises server is just as dangerous as poor cloud configuration.

Common Misconception

All cloud providers offer the same level of security compliance.

What to Teach Instead

Compliance certifications vary significantly by provider and by the specific service within a provider's portfolio. A cloud service certified for HIPAA in one region may not carry the same certification in another. Students benefit from the jigsaw activity that surfaces these distinctions through peer teaching.

Active Learning Ideas

Jigsaw: IaaS, PaaS, and SaaS Security Profiles

Divide students into three expert groups, each researching the shared responsibility model for one cloud service type using a provided article and diagram. After 15 minutes of expert-group work, students reorganize into mixed groups containing one expert from each type. Each expert teaches their model, and the mixed group maps responsibilities onto a shared chart, identifying where security gaps commonly occur.

45 min·Small Groups

Design Sprint: Migrate an App to the Cloud

Pairs receive a brief description of a small web application handling student health records. They must design a cloud migration plan that addresses: identity and access management, data encryption at rest and in transit, logging and monitoring, and incident response. Pairs present a one-page security plan to another pair for critique before the class discusses common patterns and gaps.

50 min·Pairs

Think-Pair-Share: When Cloud Goes Wrong

Students individually read a short summary of a real cloud misconfiguration breach (e.g., exposed S3 bucket). They identify which layer of the shared responsibility model failed and who was accountable. Pairs compare interpretations, then the whole class builds a matrix of breach types mapped to responsibility layers.

30 min·Pairs

Real-World Connections

• Companies like Netflix use AWS extensively, requiring their engineers to understand the shared responsibility model to secure their streaming service and customer data, from managing virtual servers to protecting user account information.
• Financial institutions migrating to cloud platforms like Microsoft Azure must implement robust identity and access management solutions to comply with regulations and protect sensitive transaction data, a task falling under their responsibility.
• Software developers at startups building mobile apps on Google Cloud Platform (PaaS) can focus on coding features, relying on Google to manage the server infrastructure, but are still responsible for securing their application code and user authentication.

Assessment Ideas

Exit Ticket

Provide students with a scenario: 'A small e-commerce business is moving its website to a PaaS cloud environment.' Ask them to list two security tasks the cloud provider is responsible for and two tasks the business is responsible for.

Discussion Prompt

Pose the question: 'Imagine you are designing a cloud security strategy for a new social media application. What are the top three security concerns you would address first, and why?' Facilitate a class discussion comparing student approaches.

Quick Check

Present students with a list of security responsibilities (e.g., patching the OS, encrypting data at rest, managing firewall rules, securing physical data centers). Have them categorize each item as 'Provider Responsibility' or 'Customer Responsibility' for IaaS, PaaS, and SaaS models.

Frequently Asked Questions

What is the shared responsibility model in cloud security?

It defines which security tasks belong to the cloud provider and which belong to the customer. Providers always secure the physical hardware, network, and virtualization layer. Customers are responsible for their data, user identities, and application configuration. The exact split depends on whether you use IaaS, PaaS, or SaaS.

What are the most common cloud security mistakes companies make?

The most frequent issues include misconfigured storage buckets left publicly accessible, overly permissive identity and access management roles, lack of encryption for sensitive data at rest, and inadequate logging that delays breach detection. Most major cloud breaches trace back to configuration errors rather than provider-side vulnerabilities.

What is the difference between IaaS, PaaS, and SaaS?

IaaS provides raw virtual machines and storage where you manage the OS and software. PaaS provides a managed runtime so you only deploy your application code. SaaS delivers a complete application you access through a browser. As you move from IaaS to SaaS, the provider handles more, but you also have less control over security configurations.

How does active learning help students understand cloud security decisions?

Cloud security is full of contextual trade-offs that resist memorization. Design sprint activities, where students build an actual migration plan for a realistic app, force them to apply the shared responsibility model under constraints. Peer critique during the sprint also exposes blind spots that rote learning would miss entirely.