If your data is breached in the cloud, is it Amazon's fault or yours? In this video, Sec Guy breaks down the Shared Responsibility Model, explaining why Capital One was liable for their massive breach (SSRF) despite using a secure cloud provider. We also cover the evolution from IaaS to Serverless (FaaS) and why Data Sovereignty (Microsoft Ireland Case) means your data is subject to the laws of the physical land it sits on.

New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+

[ ] Domain 3.2: Cloud Computing Concepts (IaaS, PaaS, SaaS, Public/Private/Hybrid)

[ ] Domain 5.3: Third-Party Risk Management (Shared Responsibility Model)

[ ] Domain 2.2: Vulnerabilities (SSRF - Server-Side Request Forgery)

CISSP

[ ] Domain 3: Security Architecture (Cloud Service Models & Microservices)

[ ] Domain 1: Security and Risk Management (Legal & Regulatory Issues - Data Sovereignty)

CISM

[ ] Domain 2: Information Risk Management (Cloud Risk Assessment)

CRISC

[ ] Domain 2: IT Risk Assessment (Outsourcing & Cloud Vendor Risk)

CCSP

[ ] Domain 1: Cloud Concepts (IaaS, PaaS, SaaS, FaaS, Shared Responsibility)\

[ ] Domain 6: Legal, Risk, and Compliance (Cross-Border Data Transfer & GDPR)

SecurityX (CompTIA)

[ ] Domain 2.0: Security Architecture (Cloud Native Security Controls - CNAPP, CWPP, CSPM)

GIAC GSEC (SANS)

[ ] Cloud Security: Fundamentals & Shared Responsibility

AWS CSS (Certified Security – Specialty)

[ ] Domain 2: Infrastructure Security (Shared Responsibility Model)

Pentest+ (CompTIA)

[ ] Domain 3: Attacks and Exploits (Cloud Metadata Attacks & SSRF)

CEH (Certified Ethical Hacker)

[ ] Domain 11: Cloud Computing (Cloud Attacks & Misconfigurations)

SecAI+

[ ] AI Security: Securing AI Models on Serverless Infrastructure (FaaS)

[Timestamps]

0:00 - Intro: The Cloud is Just Someone Else's Computer?

0:37 - IaaS (Infrastructure as a Service): Renting the House (AWS EC2)

1:00 - PaaS (Platform as a Service): Staying in a Hotel (Google App Engine)

1:23 - SaaS (Software as a Service): Dining Out (Salesforce, Gmail)

1:38 - FaaS (Serverless): The Ultimate Abstraction (AWS Lambda)

2:10 - The Shared Responsibility Model: Security "OF" vs. Security "IN"

2:45 - Case Study: Capital One Breach (SSRF & Misconfiguration)

3:30 - Data Sovereignty: The Microsoft Ireland Case & GDPR

4:20 - The Cloud Security Stack: CSPM, CWPP, CASB, & CNAPP

5:20 - Summary: Control vs. Convenience

5:40 - Outro: Stay Safe, Stay Secure.

Original Sec Guy video: https://www.youtube.com/watch?v=oxDZf-7dzVQ