Logo
Cybersecurity

Cloud Security Starts Below the Cloud

Knowing where every security setting lives is useful. Understanding what happens underneath those settings is what helps when something behaves unexpectedly.

ITSEC AsiaITSEC Asia
|
Sep 28, 2026
Cloud Security Starts Below the Cloud

A cloud security engineer sees unusual traffic reaching an application. The access policy looks correct. The workload configuration looks normal. Nothing obvious is flashing red.

Now the investigation moves somewhere less convenient.

Where did the request resolve? Which route did it take? What identity did the workload use? Which protocol carried the connection? Did traffic pass through an edge service, private network or another cloud environment?

The cloud console can answer some of those questions. Networking knowledge answers the rest.

An ITU Academy course running through 28 September 2026 offers an interesting picture of how interconnected modern infrastructure has become. Its curriculum combines cloud and edge computing with IPv6, QUIC, DNS, SD-WAN, fixed and mobile broadband, IoT, AI and cybersecurity. ITU Academy

For cybersecurity workforce development, the combination makes sense. Cloud security increasingly requires people who understand what the cloud is built on.

Abstraction Doesn’t Remove the Fundamentals

Cloud services are very good at hiding infrastructure complexity. That’s part of their appeal.

Security teams don’t always have the same luxury.

A DNS configuration can redirect users to the wrong destination. A routing decision can expose a service unexpectedly. Identity controls determine which workloads can communicate. Encryption protects connections, while logging determines whether investigators can reconstruct what happened later.

Useful cloud security skills therefore extend across several layers:

  • Network fundamentals including addressing, routing and segmentation
  • DNS and how applications discover services
  • Identity and permissions for people and workloads
  • Cloud and edge architecture
  • Encryption and secure communications
  • Logging and telemetry across distributed systems
  • Application and API behaviour

Nobody needs to become an expert in every layer. Teams do need enough shared technical language to recognize where a problem may actually live.

Otherwise, “the cloud is broken” becomes a surprisingly durable diagnosis.

Product Knowledge Has a Half-Life

Platform-specific skills still matter. Engineers need to know how to configure the systems their organization actually uses.

The problem comes when product familiarity is mistaken for underlying capability.

Interfaces change. Services are renamed. New architectures appear. A professional who understands why segmentation matters can transfer that reasoning to another environment. Someone who understands DNS can investigate resolution problems whether the application runs in a data centre, public cloud or edge environment.

NIST’s NICE Framework takes a similar task-oriented view. It describes cybersecurity work through Task, Knowledge and Skill statements that can be used across roles and organizations. NIST

That’s useful for cloud security because the technology will keep changing faster than a static curriculum.

Train Across the Boundaries

Cloud security training becomes more realistic when learners have to cross technical layers.

Give participants a cloud-hosted application with an access problem. The obvious security configuration can be correct while the actual issue sits in DNS, workload identity or network routing. Let them trace the path, test assumptions and determine which team needs to act.

The exercise teaches something broader than a configuration procedure. It develops the ability to reason across systems.

That approach fits practical learning at ITSEC Cyber & AI Academy, where hands-on environments can connect cloud, network and cybersecurity concepts through scenarios that behave more like real infrastructure.

Cloud platforms make infrastructure easier to consume.

They don’t make the infrastructure underneath irrelevant.

Explore practical cybersecurity and AI training at ITSEC Cyber & AI Academy.

References: ITU Academy: Future Fixed and Mobile Broadband Internet, Cloud Computing and IoT/AI, 21–28 September 2026 · NIST: Getting Started With the NICE Framework · NIST: NICE Framework Components v2.2.0

Share this post

You may also like

The Next Cyber Skills Gap May Be Hidden in Your Encryption
Cybersecurity

The Next Cyber Skills Gap May Be Hidden in Your Encryption

Quantum computing has a talent problem hiding inside a technology problem. The discussion around post quantum cryptography often starts with algorithms. NIST has already standardized the first post quantum algorithms and continues to update technical standards. In June, it released working drafts for bringing post quantum cryptography into Personal Identity Verification credentials, including a model that supports gradual migration from classical cryptography. NIST also finalized updated crypto agility guidance on 29 June. The concept is straightforward: organizations need the ability to replace cryptographic algorithms and implementations without causing major disruption. Doing that requires people who understand considerably more than the names of new algorithms. FIRST, FIND THE CRYPTOGRAPHY Ask an organization where it uses encryption and the first answers may be predictable: VPNs, databases, certificates and websites. Keep looking and the list grows. Cryptography can be embedded in applications, APIs, identity systems, cloud services, hardware, third party software, backups, digital signatures and old systems that everyone politely avoids touching. Preparing for a cryptographic transition therefore requires capabilities such as: * Discovering where cryptographic algorithms,

ITSEC AsiaITSEC Asia
|
Sep 11, 2026 — 3 minutes read
Post-Quantum Cryptography Readiness with ITSEC
Cybersecurity

Post-Quantum Cryptography Readiness with ITSEC

For decades, public-key cryptography has been the backbone of protecting sensitive information, such as financial transactions, personal data, corporate communications, and government secrets. Whether logging into a secure banking app, shopping online, or browsing encrypted websites (like HTTPS), public key infrastructure (PKI) protects your data from cybercriminals. However, the rise of quantum computing introduces transformative and potentially disruptive challenge to this foundation of digital trust. THE QUANTUM REVOLUTION Quantum computers can perform complex computations faster than even the most advanced current supercomputers. While this capability promises breakthroughs in drug discovery and healthcare, materials science or Artificial Intelligence (AI), it also poses a significant threat to current cryptographic systems. Quantum computers could break widely used publickey cryptographic systems (e.g., RSA, ECC), compromising critical infrastructure security such as energy grids, financial systems, and sensitive government communication networks. Compromised public-key cryptography could lead to forged digital certificates or signatures, undermining trust in banking, healthcare, and government services. Quantum cryptography attacks could also compromise billions of connected devices, from smart homes to Industrial Control Systems (ICS), by

ITSEC AsiaITSEC Asia
|
Jul 11, 2025 — 4 minutes read
Is Using a VPN Really Safe? Here’s the Reality Check.
Cybersecurity

Is Using a VPN Really Safe? Here’s the Reality Check.

INTRODUCTION Today, almost everything we do happens online, from working and studying to shopping and banking. While the internet makes life easier, it also comes with certain risks, especially when it comes to privacy and data security. Many people connect to public Wi-Fi in places like cafés, airports, or hotels without realizing that these networks may not always be secure. In some cases, attackers can monitor or intercept data that travels through these connections. This is where VPN apps become useful. A VPN app helps create a safer internet connection by protecting your data and hiding your online identity. Even if you are using an open network, a VPN can help keep your activity more private. This article will explain what a VPN app is, how it works, and why it has become an important tool for safer internet use. Source: pr.norton.com [https://pr.norton.com/blog/privacy/what-is-a-vpn?utm_], security.org [https://www.security.org/vpn/?utm_], fortinet.com [https://www.fortinet.com/resources/cyberglossary/vpn-wifi?utm_] WHAT IS A VPN APP? A VPN app is a tool that helps protect your internet connection and online activity. VPN stands for Virtual Private Network.

ITSEC AsiaITSEC Asia
|
Mar 13, 2026 — 6 minutes read

Receive weekly
updates on new posts

Subscribe