CMIT 436: Security in the Cloud

CMIT 436 at the University of Maryland Global Campus is a hands-on study of how to secure critical assets once they live in someone else's data center.

UMGC designed it to help prepare for the ISC2 Certified Cloud Security Professional (CCSP) exam. Its stated goal is to apply the principles of confidentiality, integrity and availability (the CIA triad) to digital resources in cloud environments.

The prerequisite is CMIT 326, which introduces cloud technologies. What makes CMIT 436 demanding is that familiar security ideas behave differently in the cloud: you no longer control the hardware, responsibilities are split with the provider, and a single misconfigured setting can expose data to the whole internet.

What CMIT 436 Covers

Because the course follows the CCSP, its content tracks the six CCSP domains:

Key Concepts Explained

The Shared Responsibility Model

The provider secures the cloud itself; the customer secures what they put in it. Where the line falls depends on the service model.

CIA in the Cloud

• Confidentiality: encryption at rest and in transit, key management and tight identity controls.
• Integrity: versioning, logging and checks that detect unauthorised change.
• Availability: redundancy across zones or regions, backups and tested recovery.

Misconfiguration as the Main Risk

Many cloud breaches start with settings, not exploits: public storage buckets, open management ports or over-broad permissions.

Typical Assignments and How to Approach Them

Contracts, Compliance and Data Location

Cloud security is partly a legal question. Where data is physically stored can decide which privacy laws apply, and the customer usually remains accountable for personal data even when a provider holds it.

Assignments on this topic reward specifics: what the service agreement promises on availability and breach notification, which audit reports the provider can share, and how the organization would get its data back if it left. A paragraph on exit planning often separates a thorough answer from a generic one.

Identity as the New Perimeter

In the cloud, anyone with valid credentials can reach the management console from anywhere. That makes identity and access management the first line of defense.

Strong designs enforce multi-factor authentication, grant least privilege through roles rather than individual users, avoid long-lived access keys, and review permissions regularly. Logging every administrative action means misuse can be traced. When an assignment asks for your top control, a well-argued identity control is often the best answer.

Where Students Get Stuck

• Assuming the provider handles security. Always state which party owns each control.
• Treating cloud like on-premises. Firewalls and patching still matter, but identity is now the main perimeter.
• Encryption without key management. Say who holds the keys and how they are rotated.
• Ignoring logging. Without logs you cannot detect or investigate an incident.

Study Tips for CMIT 436

• Draw a shared responsibility table for IaaS, PaaS and SaaS and keep it beside you.
• Organize your notes by the six CCSP domains.
• Practice explaining one control per CIA goal for any scenario.
• Clean up lab resources after each session.

How We Help with CMIT 436

Send the assignment brief, the cloud scenario, any lab notes and the rubric. A writer with cloud security knowledge can explain concepts, review your assessment or design, or prepare a custom paper for study. We never log in to your cloud account or UMGC classroom.

GradeEssays is independent of the University of Maryland Global Campus. Our work is a reference aid within UMGC's academic integrity policy, written from scratch and plagiarism-checked, with free revisions within the scope of your original request.