Skip to main content
Cloud Security in Cloud Migration

Cloud Security in Cloud Migration

$250.00
When you get access:
Course access is prepared after purchase and delivered via email
Your guarantee:
30-day money-back guarantee — no questions asked
Toolkit Included:
Includes a practical, ready-to-use toolkit containing implementation templates, worksheets, checklists, and decision-support materials used to accelerate real-world application and reduce setup time.
Who trusts this:
Trusted by professionals in 160+ countries
How you learn:
Self-paced • Lifetime updates
Adding to cart… The item has been added

What does the Cloud Security in Cloud Migration course cover?

Cloud Security in Cloud Migration is covered here in 8 modules: Assessing Cloud Security Posture Prior to Migration, Designing Secure Cloud Landing Zones, Securing Data During and After Migration and 5 more. The outline lists 48 specific topics, opening with conduct a risk assessment of on-premises workloads to determine which systems can safely be migrated based on data sensitivity and compliance requirements.

How do you approach Cloud Security in Cloud Migration step by step?

The work is sequenced in 8 stages. It starts with Assessing Cloud Security Posture Prior to Migration, moves through Designing Secure Cloud Landing Zones and Securing Data During and After Migration, and ends at Securing Cloud-Native Applications and Development Pipelines. Each stage carries its own topic list, so the sequence is followed rather than summarised.

What is in Module 1 of the Cloud Security in Cloud Migration course?

Module 1 is Assessing Cloud Security Posture Prior to Migration. It works through conduct a risk assessment of on-premises workloads to determine which systems can safely be migrated based on data sensitivity and compliance requirements., map existing identity and access management policies to target cloud provider models, identifying gaps in role definitions and authentication mechanisms., inventory legacy applications with hardcoded credentials or.

How is the Cloud Security in Cloud Migration course delivered?

The Cloud Security in Cloud Migration course is fully self-paced with immediate online access after enrolment. Access does not expire and future updates are included at no cost. It can be taken on any device, and a certificate of completion is issued by The Art of Service when you finish.

How much does the Cloud Security in Cloud Migration course cost?

The Cloud Security in Cloud Migration course is $251 as a one time payment. There is no subscription, no per seat licence and no hidden fee. Enrolment carries a 30 day satisfied or refunded guarantee, so it can be assessed in full before you commit.

Closely related courses: Cloud Migration in Cloud Migration, Cloud Migrations in Cloud Migration, Google Cloud Migration in Cloud Migration, Cloud Migration Costs in Cloud Migration.

More answers: what you get with every course, refund policy, all help answers.

This curriculum spans the equivalent of a multi-workshop technical engagement, covering the design, migration, and operational enforcement of cloud security controls across identity, data, network, and development environments, comparable to an internal capability-building program for cloud security teams in large enterprises.

Module 1: Assessing Cloud Security Posture Prior to Migration

  • Conduct a risk assessment of on-premises workloads to determine which systems can safely be migrated based on data sensitivity and compliance requirements.
  • Map existing identity and access management policies to target cloud provider models, identifying gaps in role definitions and authentication mechanisms.
  • Inventory legacy applications with hardcoded credentials or unpatched vulnerabilities that require refactoring before migration.
  • Evaluate data residency and sovereignty constraints to determine permissible cloud regions and availability zones.
  • Define security baselines for workloads using CIS Benchmarks or NIST frameworks tailored to the cloud environment.
  • Establish cross-functional alignment between security, infrastructure, and application teams on security ownership during and after migration.

Module 2: Designing Secure Cloud Landing Zones

  • Implement multi-account strategies using AWS Organizations, Azure Management Groups, or GCP Folders to enforce isolation between production, development, and sensitive workloads.
  • Configure centralized logging and monitoring at the organization level to capture control plane and data plane events across all accounts.
  • Enforce network segmentation using hub-and-spoke or mesh topologies with managed firewalls and routing policies.
  • Deploy identity federation using SAML or OIDC to integrate with existing enterprise identity providers, avoiding local cloud user creation.
  • Define and automate guardrail policies using Infrastructure as Code (IaC) tools like Terraform or CloudFormation with policy-as-code frameworks such as HashiCorp Sentinel or AWS Config Rules.
  • Set up secure initial administrative access using just-in-time (JIT) and privileged access management (PAM) solutions to limit standing privileges.

Module 3: Securing Data During and After Migration

  • Classify data by sensitivity level and apply encryption accordingly—enabling SSE-S3, SSE-KMS, or client-side encryption based on regulatory needs.
  • Implement data loss prevention (DLP) policies in transit and at rest using cloud-native tools like Amazon Macie, Azure Information Protection, or Google Cloud DLP.
  • Manage encryption key lifecycles using cloud key management services (KMS) with regular rotation and separation of duties for key administrators.
  • Design secure data pipelines for bulk migration using encrypted connections and temporary access credentials with expiration.
  • Apply retention and deletion policies aligned with legal holds and data minimization principles to prevent indefinite data storage.
  • Monitor for unauthorized data access patterns using anomaly detection rules in security information and event management (SIEM) systems.

Module 4: Identity and Access Management at Scale

  • Define granular least-privilege IAM roles and policies using attribute-based access control (ABAC) to reduce policy sprawl.
  • Integrate workload identities with Kubernetes service accounts using cloud-specific mechanisms like AWS IAM Roles for Service Accounts (IRSA) or Azure Workload Identity.
  • Implement service account hardening by disabling user-like access, enforcing key rotation, and monitoring for misuse.
  • Enforce conditional access policies based on IP location, device compliance, and risk level for human users.
  • Conduct quarterly access reviews using automated certification campaigns to revoke unnecessary permissions.
  • Deploy privileged identity management (PIM) for time-bound elevation of administrative privileges with audit trail capture.

Module 5: Securing Network Architecture in the Cloud

  • Design hybrid connectivity using AWS Direct Connect, Azure ExpressRoute, or Google Cloud Interconnect with encrypted tunnels and BGP security controls.
  • Implement micro-segmentation using security groups and network firewalls to restrict east-west traffic between workloads.
  • Configure DNS protection using private zones and DNS filtering to prevent data exfiltration via DNS tunneling.
  • Deploy Web Application Firewalls (WAF) in front of public-facing applications with custom rules to block OWASP Top 10 threats.
  • Enforce egress filtering using firewall appliances or cloud-native controls to prevent unauthorized outbound connections.
  • Isolate high-risk workloads in dedicated VPCs/VNets with no public internet access and strict peering policies.

Module 6: Continuous Security Monitoring and Incident Response

  • Aggregate logs from cloud platforms, workloads, and third-party tools into a centralized SIEM with normalized schemas for correlation.
  • Develop detection rules for suspicious activities such as root account usage, unauthorized configuration changes, or mass data downloads.
  • Integrate cloud security posture management (CSPM) tools to continuously scan for misconfigurations and compliance drift.
  • Automate response playbooks using SOAR platforms to quarantine resources, disable credentials, or isolate networks upon detection.
  • Conduct tabletop exercises simulating cloud-specific incidents like S3 bucket exposure or compromised container images.
  • Establish cloud-specific forensic data collection procedures, including memory dumps, container snapshots, and API call logs.

Module 7: Governance, Compliance, and Audit Readiness

  • Map cloud resource configurations to regulatory frameworks such as HIPAA, GDPR, or PCI-DSS using automated compliance scoring tools.
  • Implement tagging standards for cost, ownership, environment, and data classification to support policy enforcement and reporting.
  • Generate audit trails for configuration changes using cloud-native tools like AWS CloudTrail, Azure Activity Log, or GCP Audit Logs.
  • Define ownership models for cloud resources to ensure accountability and timely remediation of security findings.
  • Coordinate third-party audits by preparing evidence packages that demonstrate control implementation across shared responsibility boundaries.
  • Establish change advisory boards (CABs) for high-risk modifications to network, identity, or security configurations.

Module 8: Securing Cloud-Native Applications and Development Pipelines

  • Integrate static application security testing (SAST) and software composition analysis (SCA) into CI/CD pipelines to block vulnerable code.
  • Scan container images for OS vulnerabilities and misconfigurations using tools like Trivy or Amazon ECR scanning before deployment.
  • Enforce immutable infrastructure principles by preventing runtime modifications and requiring redeployment for changes.
  • Secure artifact repositories with access controls, virus scanning, and digital signing to prevent tampering.
  • Implement infrastructure as code (IaC) security scanning using Checkov or tfsec to detect risky configurations pre-deployment.
  • Define deployment gates in CI/CD workflows that require security approval for production promotions.
!