Sessions emphasized why cloud security is now a critical component of national cyber resilience as studies show that 65% of organisations reported at least one-cloud related security incident in the past year.  

Participants were introduced to cloud threat modelling, using practical use cases. Sessions highlighted how threat modelling helps organisations systematically consider “what can go wrong” by identifying critical assets, potential threats and appropriate mitigation measures. While moving to the cloud can eliminate certain traditional infrastructure risks, discussions underlined that it also introduces new threat vectors. This makes structured threat modelling essential for reducing attack surfaces, improving security awareness and supporting compliance efforts.  

Sessions also explored identity and access management (IAM) in cloud environments, supported by a live demonstration as well as cloud visibility through logs, alerts and monitoring tools offered by different cloud service providers. Participants examined how effective visibility enables faster detection and response, and how misconfigurations or excessive permissions remain among the most common causes of cloud incidents.   

Second day concluded with a focus on cloud incident response and automation. Participants were walked through the key stages of a cloud incident response process: from detection and evidence acquisition to containment, recovery and post-incident analysis. They also discussed the advantages and limitations of in-cloud, out-cloud and hybrid approaches. A hands-on exercise allowed participants to investigate a simulated cloud breach using logs, tracing initial access vectors, persistence mechanisms, lateral movement and data exfiltration. These sessions on automation, response workflows and playbooks highlighted how automation can significantly enhance response speed, consistency and scalability, helping organisations move from reactive to proactive cloud security operations. 

Training is delivered in collaboration between the European Union (facilitated by the EU Delegation to Japan and the EU Delegation to Thailand and implemented by the EU-funded project EU CyberNet), the ASEAN-Japan Cybersecurity Capacity Building Centre (AJCCBC), the National Cyber Security Agency of Thailand (NCSA) and the Japan International Cooperation Agency (JICA).   

Photos: https://flic.kr/s/aHBqjCHAqE