Cybersecurity and Cloud: Why They Go Hand in Hand
A cybersecurity student's first look at AWS, and why cloud and security are really two sides of the same skill set, from IAM and least privilege to VPCs and security groups.
When I started learning cloud computing, I treated it as a separate thing from cybersecurity. To me, AWS was servers, storage, and applications, while security was about protecting networks, systems, and data. I came to AWS as a cybersecurity student, curious about where modern systems actually run. The more I learned, the more those two worlds overlapped.
The cloud changes where security happens
In a traditional setup, you think about a physical server, a local network, a company's laptops. In the cloud, those things still exist, just in a different form. A single application on AWS can involve compute, databases, storage, networking, and APIs, and each one has to be configured and secured properly. So learning cloud ends up meaning learning how to secure it too.
IAM was my first "oh, this is security" moment
The first service where this really clicked for me was IAM. The basic question is simple: who should be allowed to access what? But in the cloud, a wrong answer can be costly. Giving a user or service more permissions than it needs creates risk for no benefit, which is exactly the idea behind least privilege. While reading about IAM, I noticed how much of AWS's own guidance pushes you toward this thinking, like avoiding everyday use of the root account and granting only the permissions a task requires. It was a concept I'd already met in cybersecurity, now showing up as a real, practical part of how AWS works.
Networking felt familiar too
As a cybersecurity student I'd already worked with IP addresses, ports, firewalls and traffic. AWS carries those ideas into VPCs, subnets and security groups. The terminology was new, but the question underneath was the same: what should be allowed to talk to what? Seeing that a security group is essentially a set of rules about which traffic is allowed in and out made the cloud feel a lot less intimidating.
Security isn't something you add at the end
The biggest thing I've taken away so far is that security has to be part of the design from the start, not a step after deployment. Before launching anything, you should be asking:
- Who gets access?
- Where will the data be stored?
- What actually needs to be exposed to the internet?
- How will the data be protected?
- How would we notice suspicious activity?
- What happens if something goes wrong?
Because cloud infrastructure can grow and change quickly, skipping these questions early gets expensive later.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article