AI and cloud security
Cloud security fundamentals and the security side of AI tools at work, explained defensively and linked to official guidance.
Start here
- AI assistants at work and confidential dataIs it safe to use AI chatbots at work? How information typed into AI tools can be exposed, and what the OAIC and ASD say about personal and work data.
- The cloud shared responsibility model, explainedThe cloud shared responsibility model explained: how Microsoft splits security between provider and customer, and why data and identities stay yours.
- Cloud identity and access management: the basics for small teamsCloud identity and access management basics explained: least privilege, MFA for admins, roles vs users, service accounts and access reviews.
AI security
- AI agents and permissions: what they can reach and why it mattersAI agent permissions explained: connected data, tool access, least privilege, human approval, logging and prompt injection, as ASD and OWASP describe.
- AI assistants at work and confidential dataIs it safe to use AI chatbots at work? How information typed into AI tools can be exposed, and what the OAIC and ASD say about personal and work data.
- Prompt injection explained, for defendersWhat is prompt injection? How hidden instructions in emails, files or web pages can steer AI assistants, and defences ASD, Microsoft and OWASP describe.
AI governance
Cloud security
- AWS security fundamentals for small teamsAWS security best practices for small teams: root user MFA, IAM Identity Center, least privilege, CloudTrail, S3 public access and budget alerts.
- Azure security fundamentals for small teamsAzure security basics for small teams: Entra ID and mandatory MFA, subscriptions and RBAC, Defender for Cloud's free tier, networks and Azure Backup.
- Cloud identity and access management: the basics for small teamsCloud identity and access management basics explained: least privilege, MFA for admins, roles vs users, service accounts and access reviews.
- Cloud logging and monitoring: what to log, how long to keep it and when to alertCloud logging and monitoring basics: what to log, the Azure activity log, AWS CloudTrail, retention, alerts and the ACSC's event logging best practices.
- Cloud storage permissions: why data ends up public and how access controls workCloud storage permissions explained: why buckets and containers become public, S3 Block Public Access, Azure anonymous access, sharing links and auditing.
- Secrets and API keys: why they leak and how secret managers and scanning workHow to store API keys and secrets securely: why keys in code leak, how Azure Key Vault and AWS Secrets Manager work, rotation and GitHub secret scanning.
- The cloud shared responsibility model, explainedThe cloud shared responsibility model explained: how Microsoft splits security between provider and customer, and why data and identities stay yours.
Using AI safely
AI and cloud security: questions people ask
Is it safe to put work information into AI chatbots?
Our guide explains how information typed into AI tools can be exposed, and what the OAIC and ASD say about personal and work data. AI assistants and confidential data
Who is responsible for security in the cloud?
Cloud providers secure the platform, and customers stay responsible for their accounts, data and settings. Our guide explains where the line sits. The shared responsibility model
Do small teams need an AI use policy?
Our guide outlines what a short AI use policy usually covers, drawing on OAIC and ASD guidance. AI governance basics