Cloud Computing Security

Active learning works especially well for cloud computing security because students need to experience the gaps between provider promises and customer obligations. Hands-on activities let them see how a misconfigured firewall or an open storage bucket can expose data, even when the cloud provider is fully compliant.

• 12th Grade
• Computer Science
• 3 activities
• 30 min–50 min

Learning Objectives

1. Analyze the division of security responsibilities between cloud providers and customers within the shared responsibility model.
2. Compare the security implications and customer management overhead for IaaS, PaaS, and SaaS cloud deployment models.
3. Design a foundational security strategy, including access control and data protection measures, for migrating a web application to a chosen cloud platform.
4. Evaluate potential security threats, such as misconfigurations and unauthorized access, specific to cloud environments.
5. Explain the role of encryption and identity management in securing data and resources in the cloud.

Jigsaw

⏱ 45 min·Small Groups

Jigsaw: IaaS, PaaS, and SaaS Security Profiles

Divide students into three expert groups, each researching the shared responsibility model for one cloud service type using a provided article and diagram. After 15 minutes of expert-group work, students reorganize into mixed groups containing one expert from each type. Each expert teaches their model, and the mixed group maps responsibilities onto a shared chart, identifying where security gaps commonly occur.

Prepare & details

Analyze the shared responsibility model in cloud security.

Facilitation Tip: During the Jigsaw, assign each expert group a single cloud model and require them to prepare a two-minute mini-lecture with one real-world breach example to anchor their security profile.

Setup: Flexible seating for regrouping

Materials: Expert group reading packets, Note-taking template, Summary graphic organizer

• Understand
• Analyze
• Evaluate
• Relationship Skills
• Self-Management

Case Study Analysis

⏱ 50 min·Pairs

Design Sprint: Migrate an App to the Cloud

Pairs receive a brief description of a small web application handling student health records. They must design a cloud migration plan that addresses: identity and access management, data encryption at rest and in transit, logging and monitoring, and incident response. Pairs present a one-page security plan to another pair for critique before the class discusses common patterns and gaps.

Prepare & details

Differentiate between various cloud deployment models (IaaS, PaaS, SaaS) and their security implications.

Facilitation Tip: When running the Design Sprint, give teams exactly 20 minutes to sketch a threat model before they begin their migration diagram, forcing them to surface security concerns up front.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Think-Pair-Share

⏱ 30 min·Pairs

Think-Pair-Share: When Cloud Goes Wrong

Students individually read a short summary of a real cloud misconfiguration breach (e.g., exposed S3 bucket). They identify which layer of the shared responsibility model failed and who was accountable. Pairs compare interpretations, then the whole class builds a matrix of breach types mapped to responsibility layers.

Prepare & details

Design a basic security strategy for migrating an application to the cloud.

Facilitation Tip: For the Think-Pair-Share, provide a deliberately incomplete incident report so pairs must identify missing details about the cloud provider’s shared responsibility before sharing with the class.

Setup: Standard classroom seating; students turn to a neighbor

Materials: Discussion prompt (projected or printed), Optional: recording sheet for pairs

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

Teaching This Topic

Start by modeling a quick cloud setup yourself so students see how easily defaults can be insecure. Then transition to co-constructing a shared responsibility chart on the board; research shows students retain shared-responsibility concepts better when they build the model collaboratively rather than receive it as a slide. Avoid spending more than 15 minutes on lecture—move immediately into activities where students apply the model.

What to Expect

By the end of these activities, students will clearly distinguish provider duties from customer duties, cite concrete examples of cloud breaches linked to misconfiguration, and propose secure configurations for IaaS, PaaS, and SaaS deployments.

Watch Out for These Misconceptions

Common Misconception

During Jigsaw: IaaS, PaaS, and SaaS Security Profiles, watch for students who claim providers handle all security once workloads are in the cloud.

What to Teach Instead

Use the expert group charts to guide students back to the shared responsibility model; challenge them to place each security control on the correct side of the model and cite provider documentation to verify.

Common Misconception

During Design Sprint: Migrate an App to the Cloud, watch for students who assume default cloud settings are secure.

What to Teach Instead

Have teams present their security checklists alongside their migration diagrams and ask peers to identify any default settings still in place.

Common Misconception

During Think-Pair-Share: When Cloud Goes Wrong, watch for students who blame the cloud provider for breaches without examining customer configuration.

What to Teach Instead

Use the incident reports to prompt pairs to label every control as provider or customer, then ask them to explain how a different configuration could have prevented the breach.

Assessment Ideas

Exit Ticket

After Jigsaw: IaaS, PaaS, and SaaS Security Profiles, provide each student with a short scenario (e.g., a startup using SaaS for HR). Ask them to list two customer tasks and two provider tasks, then turn in their responses before leaving.

Discussion Prompt

After Design Sprint: Migrate an App to the Cloud, ask student teams to share their top three security concerns and mitigation strategies. Facilitate a whole-class discussion comparing which controls were most frequently chosen and why.

Quick Check

During Think-Pair-Share: When Cloud Goes Wrong, display a list of security responsibilities on the board and have students categorize each item for IaaS, PaaS, and SaaS using colored sticky notes, then reveal the correct answer set as a class.

Extensions & Scaffolding

• Challenge early finishers to design a multi-cloud deployment that balances cost and security, then present their risk-mitigation strategy to the class.
• Scaffolding for struggling students: provide a partially completed security checklist for PaaS with three missing items; they fill in the blanks and explain each choice.
• Deeper exploration: invite a local cloud security practitioner to share a 15-minute case study of a recent misconfiguration incident, then have students map the failure points to the shared responsibility model.

Key Vocabulary

Shared Responsibility Model	A cloud security framework outlining which security tasks are handled by the cloud provider and which are the customer's responsibility.
IaaS (Infrastructure as a Service)	A cloud service model where the provider offers virtualized computing resources over the internet, with the customer managing operating systems, middleware, and applications.
PaaS (Platform as a Service)	A cloud service model where the provider manages the underlying infrastructure and operating system, allowing customers to focus on developing and deploying applications.
SaaS (Software as a Service)	A cloud service model where the provider delivers software applications over the internet on a subscription basis, managing all aspects of the infrastructure and software.
Cloud Misconfiguration	Errors in setting up cloud security controls, such as open storage buckets or overly permissive access policies, which can lead to data breaches.