AI Era Security Notes
Apply least privilege in cloud IAM, require MFA for admins, and review OAuth app permissions quarterly — stale tokens are a common breach path.
Most organizations live in the cloud — email, files, CRM, dev tools, AI platforms. Misconfigured permissions cause headline breaches. Lesson 6 introduces identity and access management (IAM), OAuth, and zero trust principles for securing cloud and SaaS accounts.
Prerequisites: Lessons 1–5 recommended. Estimated time: 55–65 minutes.
1. Identity Is the New Perimeter
When data lives in Microsoft 365, Google Workspace, AWS, or Salesforce, the network firewall matters less than who can log in and what they can access. Identity becomes the control point.
2. IAM Basics
| Term | Meaning |
|---|---|
| Identity | User, service account, or machine identity |
| Authentication | Proving who you are (password, MFA, passkey) |
| Authorization | What you are allowed to do (roles, policies) |
| Least privilege | Minimum permissions needed for the job |
Review cloud admin roles quarterly. Remove unused accounts and stale API keys.
3. OAuth, SSO, and Third-Party Apps
When you “Sign in with Google” or connect a SaaS tool to Slack, you use OAuth delegation. Risks:
- Over-scoped permissions (“Read all email forever”)
- Shadow IT — employees connecting unapproved apps
- Token theft from compromised developer laptops
Action steps: Audit connected apps in Google/Microsoft account security pages. Revoke anything unused or suspicious.
4. Zero Trust Overview
Zero trust assumes breach and verifies every access request:
- Never trust, always verify (user, device, context)
- Micro-segmentation — limit lateral movement
- Continuous monitoring and adaptive policies
Practical personal equivalent: MFA everywhere, device encryption, and not staying logged in on shared PCs.
5. Common Cloud Misconfigurations
- Public S3 buckets or storage containers
- Admin API keys in GitHub repositories
- Overly broad IAM roles (
*:*permissions) - Missing MFA on root/cloud admin accounts
- Unpatched SaaS integrations
Tools like CSPM (Cloud Security Posture Management) scan for these in enterprises. Individuals should avoid sharing cloud storage links publicly without passwords.
6. Secrets Management (Intermediate)
Developers must never commit passwords or API keys to Git. Use environment variables, secret managers (AWS Secrets Manager, HashiCorp Vault), and pre-commit hooks scanning for leaks.
7. Securing AI Services in the Cloud
- Use enterprise tiers with data isolation for work prompts
- Apply IAM policies limiting who can call AI APIs
- Log and monitor API usage for anomalies
- Rotate API keys after employee offboarding
8. Next Steps
Continue to Lesson 7 — AI Threats and Defenses for a deep dive on AI-specific attack and defense patterns.
Frequently Asked Questions
What is zero trust?
Zero trust means verifying every access request regardless of network location — no implicit trust inside the corporate LAN.
Why is cloud IAM important?
Misconfigured permissions are a leading breach cause. Least privilege and MFA on admin accounts are essential.
Should I use SSO at home?
SSO is an organizational tool, but the habit of central identity with MFA applies — use a password manager and OAuth app audits personally too.
Want live cybersecurity classes? Join Alkademy for instructor-led cybersecurity courses with hands-on projects.