Career information: The employment projections and career examples in this article describe the broader field, not outcomes for Campus students or graduates. Hiring requirements vary, and some positions require education or experience beyond an associate degree. Completing a program or earning a certification does not guarantee employment, salary, or career advancement.
Cloud computing gives organizations access to computing resources, applications, and storage over a network without requiring them to own and operate every part of the underlying infrastructure. Resources can be provisioned and scaled as needs change. Those capabilities can support business flexibility, but using a cloud service does not automatically make a system secure or guarantee lower costs. [1] [2]
Organizations still need to understand where their information is stored, who can access it, how applications are configured, and how they will respond to an incident. Cloud computing and cybersecurity meet in that work: protecting information and keeping services available while making effective use of cloud technology. [2] [3]
What is Cloud Security?
Cloud security brings together technologies, policies, processes, and people to protect cloud-based data, applications, and infrastructure. Its goals include maintaining confidentiality, preventing unauthorized changes, and supporting reliable access to systems and information. [3] [4]
Cloud computing is a way to deliver technology resources; cybersecurity is the work of protecting systems and information. Cloud security applies that protection to cloud environments. It can involve access management, secure configurations, encryption, network controls, monitoring, incident response, and recovery planning. These measures can support privacy and compliance obligations, but no single product or configuration guarantees compliance or prevents every attack. [2] [4]
Responsibility is shared between the cloud provider and its customer organization. The division depends on the specific service, the configuration, and the applicable agreement. End users have responsibilities too, such as protecting their accounts and following their organization’s security procedures. [2]
Challenges of Cloud Computing Cybersecurity
Cloud security concerns are not new. In a 2019 Coalfire and Cybersecurity Insiders survey, 93% of respondents expressed at least moderate concern about public-cloud security, and 64% identified data loss or leakage as a concern. These historical findings describe the surveyed professionals’ views, not a current rate of cloud breaches. [5]
Separately, a 2024 MetLife and U.S. Chamber of Commerce Small Business Index survey found that 60% of small businesses identified cybersecurity threats as a top concern. That finding concerns small-business sentiment generally; it does not mean that 60% suffered an attack or that the concerns were limited to cloud services. The two surveys cover different populations and questions and should not be treated as directly comparable measurements. [6]
A practical challenge is knowing which security tasks belong to the provider and which remain with the customer. The main service models illustrate the difference:
Infrastructure as a Service (IaaS): The provider operates the underlying physical infrastructure. Customers generally remain responsible for their virtual-machine operating systems, applications, data, and configurable network and access controls. [7]
Platform as a Service (PaaS): The provider manages more of the operating environment, including the platform and runtime. Customers still manage their application code, data, identities, access, and available security settings. [7]
Software as a Service (SaaS): The provider operates the application and supporting infrastructure. Customers still need to manage their users, permitted sharing, data, and customer-controlled settings, as well as the devices used to access the service. [7]
Providers such as AWS, Microsoft Azure, and Google Cloud offer multiple kinds of services. The provider’s brand alone does not tell you who is responsible for a particular security task; review the service-specific responsibilities. [2] [7]
Interested in enrolling at Campus?
Our admissions advisors can answer your questions.
Growing Need for Cybersecurity Specialists
The U.S. Bureau of Labor Statistics projects 21% employment growth for Information Security Analysts from 2025 to 2035, representing approximately 40,600 additional jobs. Separately, it projects approximately 14,100 openings per year, including openings created when workers change occupations or leave the labor force. Net employment growth and annual openings are different measures. [8]
These are national projections for Information Security Analysts, SOC 15-1212, not all IT occupations, a separate cloud-security occupation, or Campus graduate outcomes. BLS identifies a bachelor’s degree and related work experience as typical preparation, while also recognizing alternative entry routes involving relevant training and certifications. Requirements vary by position. [8]
For someone interested in cloud security, a useful starting point is understanding how networks, operating systems, identities, applications, and data interact. The practices below show how those technical foundations connect to protecting cloud environments. [4]
Cloud Security Best Practices
User Access and the Principle of Least Privilege
The principle of least privilege means limiting access to the resources and actions needed for an assigned task. It applies to people as well as application and service identities. For example, an accounting employee may need financial records without needing access to a software-development repository. [9]
Organizations can use role-based permissions, separate administrative access, time-limited privileges, and periodic access reviews to reduce unnecessary exposure. Access should change when someone’s responsibilities change and be removed when no longer needed. Third-party and temporary access also require oversight. Least privilege reduces risk; it does not eliminate the need for monitoring or other controls. [9]
Password Managers and Strong Passwords
Use long, unique passwords for accounts that require them, and avoid reusing personal passwords for work. An attacker who obtains a stolen username and password may try the same combination on other services—a technique called credential stuffing. That differs from brute-force guessing, which tries possible passwords rather than relying only on stolen login pairs. [10] [11]
An organization-approved password manager can generate and store unique passwords, reducing the number people need to remember. Protect the password-manager account with strong authentication, secure the device, and use appropriate locking settings. A password manager does not prevent someone from seeing information displayed on an unlocked screen. [11]
Password length and resistance to guessing matter more than simply adding predictable symbols. NIST’s current guidance emphasizes screening against compromised or commonly used passwords and does not call for arbitrary character-composition rules or routine password changes without evidence of compromise. Organizations should apply requirements appropriate to their systems and obligations. [12]
Encryption
Encryption transforms readable information into a protected form that requires the appropriate cryptographic capability to recover. Cloud security should address data in transit, such as information moving between a browser and an application, and data at rest, such as stored files and databases. [13]
Organizations must also manage access to encryption keys, decide which provider-managed or customer-managed options fit their needs, and protect recovery arrangements. Encryption is not a substitute for access controls: a compromised account with permission to decrypt information may still expose it. [13]
Multi-Factor Authentication (MFA) / Two Factor Authentication
Multi-factor authentication requires proof from at least two distinct factor categories: something you know, something you have, or something you are. Two-factor authentication uses two such factors. A password plus a security question is not MFA because both are knowledge factors. Simply adding a second login screen does not necessarily add a second factor. [14]
Examples include a password combined with an authenticator, or a supported passkey or security key used with local PIN or biometric verification. Phishing-resistant options, such as appropriately implemented FIDO2/WebAuthn authentication, offer stronger protection against fraudulent sign-in sites than passwords and one-time codes alone. [12] [14]
Not all methods offer equal protection. Email is not an acceptable out-of-band authentication method under NIST’s current digital identity guidance. MFA reduces account-compromise risk but does not eliminate risks involving compromised devices, stolen sessions, or weak recovery processes. [12] [14]
SSH Keys
SSH stands for Secure Shell. It is a protocol used for secure remote access and other protected communication. SSH can support different authentication methods; public-key authentication is one option, not a requirement for every possible SSH connection. [15] [16]
With public-key authentication, the client proves possession of a private key corresponding to an authorized public key. The private key is not sent to the server. Server host keys serve a different purpose: helping the client verify the server’s identity. [16]
Protect private keys, limit the accounts and actions they authorize, and remove authorization when access is no longer needed. Do not assume that a standard SSH key automatically expires. Some environments use time-limited SSH certificates or other controls, but expiration and revocation depend on the implementation. [16]
Data Backups
Backups support recovery after accidental deletion, corruption, ransomware, or other disruption. A recovery plan should identify what needs protection, how much recent data the organization can afford to lose, and how quickly essential services must be restored. A completed backup job alone does not demonstrate successful recovery. [17]
Organizations may use managed backup services, their own tools, or a combination. Protect backup access separately from day-to-day access where appropriate, encrypt sensitive backups, and test restoration of the data and systems needed for operations. Confirm the provider’s backup and retention features rather than assuming every cloud subscription includes them. [17]
Where appropriate, immutable or retention-locked copies can provide additional protection against deletion or alteration. These controls have their own settings and limitations; their use should align with the organization’s recovery, retention, and legal requirements. [18]
Vulnerability Scanning and Risk Assessment
Vulnerability scanning helps identify known weaknesses in software, dependencies, and infrastructure. Risk assessment adds context: which systems are exposed, how sensitive the information is, whether exploitation is occurring, and what the potential impact would be. Findings need prioritization, remediation, and follow-up—not just a completed scan. [19]
Cloud environments also need configuration reviews for issues such as excessive permissions, unnecessary public access, and insecure deployment settings. Use authorized testing, assign responsibility for findings, and coordinate changes with the teams that operate the affected services. [3] [19]
A hardened image or configuration baseline provides a controlled starting point, but it must be maintained as systems and threats change. Do not automatically revert every detected change to an older image: the change may be an approved security update. Investigate unexpected changes and use controlled, tested remediation or recovery based on a current, trusted baseline. [20]
Most Prominent Cloud Security Threats
The following are important examples, not a ranked or exhaustive list. Several can occur together—for example, phishing may lead to account compromise, unauthorized access, and data theft. [3] [10]
Data Breaches
A data breach can involve unauthorized access, disclosure, loss, or other compromise of protected information. Causes can include stolen credentials, vulnerable applications, excessive permissions, exposed storage, or mistakes in handling and sharing information. A malicious intrusion is not the only way data can be exposed. [3]
Consequences may include operational disruption, loss of trust, investigation costs, and legal obligations. Which privacy or notification rules apply depends on the information, organization, and circumstances. The GDPR does not apply to every organization merely because it collects information from someone in the EU. Its scope includes processing connected to an EU establishment and certain non-EU activities involving offering goods or services to, or monitoring the behavior of, people in the EU. [21]
Phishing and Social Engineering
Social engineering uses deception to persuade people to reveal information, allow access, or take an unsafe action. Phishing is one form of that deception and is not limited to email; fraudulent messages or requests can arrive through other communication channels. A convincing message may impersonate a colleague, cloud provider, or help desk. [22]
Training should help people verify unusual requests through a known, trusted channel, avoid sharing authentication secrets, and report suspected attempts. Authentication controls and careful account-recovery processes are also important, because awareness training alone does not block every attack. [10] [14]
Distributed Denial of Service Attacks (DDoS)
A distributed denial-of-service attack uses traffic or requests from multiple sources to exhaust resources and disrupt a service. It may target network capacity or application resources. Botnets are one possible source; reflection and amplification techniques can also contribute to an attack. [23]
For a business, the result may be an unavailable website or disruption to a service employees or customers depend on. Defensive measures may include provider DDoS protection, traffic filtering, content-delivery services, rate limits, and an incident-response plan. The appropriate combination depends on the application and its exposure. Cloud scalability should not be treated as a complete defense by itself. [23]
Malicious Insiders
A malicious insider misuses legitimate access to harm the organization or its information. The person might be an employee, contractor, or other trusted party. The issue is not simply whether the person has an account, but whether they use their authorized access for an unauthorized purpose. [24]
Least privilege, separation of duties, access reviews, and appropriate monitoring can help reduce this risk. Organizations should distinguish intentional misuse from mistakes: accidental actions can also cause harm, but not every insider-related incident is malicious. [9] [24]
Malware and Malicious Code
Malware includes different forms of harmful software, such as ransomware, trojans, and keyloggers. Not all malware is a virus, and not every attack aims to remain hidden. Some steal information quietly; others encrypt data, disrupt services, or announce demands for payment. [25]
Protection requires more than antivirus software alone. Depending on the service and the customer’s responsibilities, organizations may need secure software sources, patched systems, dependency and image scanning, workload protection, monitoring, and a tested response process. Provider-managed services can change who performs these tasks, but do not remove the need to identify responsibility. [2] [19]
Ready to Pursue a Career in Cybersecurity?
Campus offers an Associate of Science in Cybersecurity, a standalone degree that combines a broad IT foundation with focused cybersecurity study. The 96-quarter-credit program is designed to be completed over eight quarters in two years, with online delivery through live, interactive instruction.
The curriculum brings together networking, operating systems, cloud infrastructure, professional practice, threat detection, vulnerability assessment, security operations, and authorized ethical hacking. Through applied assignments and a culminating capstone, students practice evaluating security challenges and communicating findings while working within legal and ethical boundaries.
Students also learn to use AI and automation responsibly to support cybersecurity analysis, threat detection, and response while evaluating their limitations and risks. The program begins with foundational concepts and supports further education and industry certification preparation.
Related industry credentials students may explore include CompTIA A+, CompTIA Network+, CompTIA Security+, CompTIA CySA+, EC-Council Certified Ethical Hacker (CEH), and AWS Certified Cloud Practitioner. This is a list of credentials to discuss with an advisor, not a promise that the degree covers every current examination objective or includes every examination fee.
Ask Campus which courses and examination versions are supported by the program and whether any exam-voucher conditions apply. Academic preparation, eligibility to test, and earning a credential are separate steps. In particular, completing college coursework does not automatically satisfy EC-Council’s official-training route for CEH examination eligibility; EC-Council determines its own eligibility requirements. [26]
To learn more about the curriculum, admission requirements, and available start dates, contact Campus Admissions at 888-675-2460. [27]
Career and Certifications Disclaimer
This article provides general educational information about cloud computing, cybersecurity practices, and career preparation. It is not a customized security assessment or legal opinion. Appropriate controls depend on the organization’s services, configurations, contracts, risks, and applicable requirements; no individual control guarantees security or compliance.
Third-party organizations establish their own certification eligibility, experience, examination, fee, scoring, and renewal requirements. Completion of a Campus program does not automatically award a certification or guarantee employment, a particular salary, promotion, or career advancement. Employment projections describe the broader occupation, not outcomes for Campus students or graduates. Hiring requirements and individual outcomes vary.
Sources
[1] National Institute of Standards and Technology — The NIST Definition of Cloud Computing, SP 800-145.
[2] Amazon Web Services — Shared Responsibility Model.
[3] OWASP — Secure Cloud Architecture Cheat Sheet.
[4] NIST — Guidelines on Security and Privacy in Public Cloud Computing, SP 800-144.
[5] Coalfire and Cybersecurity Insiders — 2019 Cloud Security Report; historical survey findings.
[7] Microsoft Learn — Shared Responsibility in the Cloud.
[9] AWS Well-Architected — Permissions Management.
[10] OWASP — Credential Stuffing Prevention Cheat Sheet.
[11] OWASP — Authentication Cheat Sheet; password controls and password managers.
[12] NIST — Digital Identity Guidelines, SP 800-63B-4: Authenticators.
[13] AWS Well-Architected — Protecting Data at Rest and Protecting Data in Transit.
[14] OWASP — Multifactor Authentication Cheat Sheet.
[15] Internet Engineering Task Force — The Secure Shell (SSH) Protocol Architecture, RFC 4251.
[16] OpenSSH — ssh(1) Manual; authentication and server-identity verification.
[17] AWS Well-Architected — Back Up Data; Secure and Encrypt Backups; Perform Periodic Recovery Tests.
[18] AWS Backup — Vault Lock; retention and deletion controls.
[19] AWS Well-Architected — Perform Vulnerability Management.
[20] AWS Well-Architected — Acquire, Maintain, and Validate Hardened Images.
[21] European Commission — Data Protection Explained; GDPR scope and applicability.
[22] NIST Computer Security Resource Center — Social Engineering glossary entry.
[23] Amazon Web Services — What Is a DDoS Attack?
[24] NIST Computer Security Resource Center — Insider Threat glossary entry.
[25] NIST Computer Security Resource Center — Malware glossary entry.
[26] EC-Council — Certification Application Process and Eligibility.