Moving data to the cloud doesn't move the responsibility for it. Once information leaves an organisation's own servers, its physical location may become uncertain, but under GDPR the accountability for protecting it stays exactly where it was – which is precisely where most cloud security failures start.

This course by the Arab British Fellowship Training Academy gives IT and security professionals a practical route through cloud security in a European context: applying GDPR and ENISA guidance to data storage, transit and access, choosing the right tools for detection and protection, and keeping cloud environments compliant and secure well after the initial setup is done.

Who Should Attend?

• Cloud computing specialists, architects and engineers, and IT professionals using cloud services.
• Information security officers and cybersecurity consultants working with cloud environments.
• Individuals responsible for GDPR compliance in organisations that rely on cloud infrastructure.

Course Objectives:

By the end of the course, participants will be able to:

• Identify the security risks specific to cloud computing environments and cloud service models.
• Apply European standards, including GDPR and ENISA guidance, to cloud data storage and processing.
• Protect sensitive data in the cloud, whether stored, in transit, or accessed through applications.
• Detect, respond to and recover from cyber threats targeting cloud infrastructure.
• Maintain continuous monitoring, reporting and compliance as cloud environments evolve.

• Module 1: Moving to the Cloud Without Losing Control
  • Cloud models (IaaS, PaaS, SaaS) and the benefits organisations gain from adopting them.
  • General threats to cloud environments, including cyberattacks, data breaches and unauthorised access.
  • Risks specific to storing and managing data in the cloud.
• Module 2: The European Rulebook: GDPR and ENISA in the Cloud
  • GDPR's impact on cloud security and what compliance looks like in practice.
  • ENISA's role in setting cloud security standards across the European Union.
  • Managing access rights and handling data breaches within a GDPR-compliant cloud setup.
• Module 3: Protecting Data at Rest and in Transit
  • Encrypting stored data and applying best practices for secure cloud storage, including key management.
  • Encrypting data during transfer between the cloud and users, and validating data integrity in transit.
  • Securing the APIs used to access and exchange cloud data.
• Module 4: Identity, Access and Application Security
  • Multi-factor authentication and identity and access management (IAM) best practices for the cloud.
  • Role-Based Access Control (RBAC), privilege minimisation and managing multi-account access.
  • Securing cloud-based applications through secure development practices and security testing.
• Module 5: Detecting and Responding to Cloud Incidents
  • Developing incident response plans specific to cloud environments.
  • Tools and techniques for detecting cyberattacks and recovering from them in the cloud.
  • Conducting risk assessments and building comprehensive cloud security policies.
• Module 6: Advanced Tools and Ongoing Operations
  • Firewalls, IDS/IPS, Cloud Access Security Brokers (CASBs) and data loss prevention (DLP) tools.
  • Continuous monitoring, security logging and audit trails for cloud environments.
  • Reporting security incidents in line with GDPR, and maintaining systems through regular patching and updates.
• Module 7: The Future of Cloud Security in Europe
  • The growing role of AI and machine learning in cloud security.
  • Security considerations for multi-cloud and hybrid cloud architectures.
  • Anticipated regulatory changes and the role of public-private collaboration in cloud security.