Learning Cloud Security

Chapter 6. Cloud Application Security

Topics covered in this chapter include:

• Application security threats

• Cloud security control mechanisms

• Web application security

• Using APIs

More and more organizations seem to be moving their primary infrastructure to cloud environments. This includes offloading previous in-house instances of mail servers and identity repositories through services like Google Workspace for email and Entra ID for identity services. It’s not only foundational infrastructure, though, that companies are pushing out to cloud providers. Getting rid of data centers saves companies a lot of money and also migrates a lot of responsibility to the provider. In addition to infrastructure, companies have been pushing other services into cloud environments. In for a penny, in for a pound, as they say. Once you start outsourcing, especially as you start downsizing your on-premises data center footprint, you start thinking about everything else you don’t need to be hosting yourself because it means one less set of systems in your data center.

Most organizations are not in the business of either real estate or information technology. They want their businesses to operate. Because everything is digital today, and you can stop me if you’ve heard this before, the businesses require applications to manage all the information they run on. Almost any application you need today can be acquired without having to invest in infrastructure. Just get your software from a provider, ...