Cloud Contracts, Laws and Networking Presentation: SD-WAN, IAM and Cybersecurity (Slides and Voice-Over Script)

Explain Cloud Contracts, Laws, and Computer Networking Influence on Cybersecurity

Purpose: Explain how cloud contracts, laws, and computer networking influence the safety and risks related to clouds. Students should demonstrate the implications of cloud contract limitations, the ability to negotiate options, the need to gain third-party protections, enable auditing, dangers of limits on claims to contract values, insurance issues, and other indirect issues. In addition, the implications of moving the perimeter of the organization in terms of performance (availability), being open to attack in the open, and other issues introduced by networking to the cloud provider.

Instructions: A PowerPoint presentation with voice-over (or similar). Include SD-WAN, IAM, and related issues. The slides should be viewable on a mobile phone and include at least one simple table and one simple figure (such as SmartArt). Record your verbal delivery in PowerPoint or Kaltura.

Original example for study purposes. Build the slides in PowerPoint and record your own narration.

Slide 1: Title

On slide: Cloud Contracts, Laws and Networking: How They Shape Cybersecurity • Student name • Course • Date

Voice-over: Hello. In this presentation, I will explain how cloud contracts, laws and networking decisions affect an organization’s security and risk when it moves systems to the cloud. I will finish with recommendations for negotiating safer contracts and designing secure connections.

Slide 2: The shared responsibility model

On slide:

• Provider secures the cloud infrastructure
• Customer secures data, identities and configurations
• Responsibilities shift by service model (IaaS, PaaS, SaaS)
• Contracts define where the line falls

Voice-over: Cloud security is shared. The provider secures physical data centers, hardware and core services, while the customer remains responsible for its data, user accounts, access settings and how services are configured. The exact split depends on whether we use infrastructure, platform or software as a service. Because many breaches result from customer misconfiguration, it is critical that the contract and our internal policies clearly state who is responsible for what.

Slide 3: Contract limitations

On slide:

• Standard “click-through” terms favor the provider
• SLAs promise uptime, not security outcomes
• Service credits instead of real compensation
• Provider can change terms or services

Voice-over: Most cloud providers offer standard terms that are written to protect the provider. Service level agreements usually guarantee availability, such as 99.9% uptime, but they rarely guarantee security. If the provider fails, the remedy is often a small service credit rather than compensation for our losses. Many agreements also allow the provider to change terms, features or data locations with limited notice. NIST guidance recommends that organizations carefully review these terms before moving sensitive data to a public cloud (Jansen & Grance, 2011).

Slide 4: Negotiating key contract terms (required table)

Voice-over: This table summarizes terms worth negotiating. Liability caps often limit the provider’s responsibility to fees paid over a short period, which may be far less than the cost of a data breach, so organizations should seek a higher cap for data protection failures. Audit rights let us verify controls, usually through independent reports such as SOC 2 Type II. We also need prompt breach notification, clear data location and exit terms, and transparency about subcontractors. Large providers may not negotiate with small customers, so we may need to compensate through insurance and internal controls.

Slide 5: Third-party protections and insurance

On slide:

• Indemnification for provider-caused breaches
• Cyber insurance to cover gaps
• Check exclusions: war, misconfiguration, unpatched systems
• Vendor risk management for the whole supply chain

Voice-over: Because contracts limit what we can recover, organizations often add other protections. Indemnification clauses require the provider to cover certain costs if its failure causes a breach. Cyber insurance can cover forensic investigation, notification, legal fees and business interruption, but policies may exclude losses from poor security practices or certain events, so the security program must meet the insurer’s requirements. Indirect risks also come from the provider’s own vendors, which is why vendor risk management should extend to subcontractors.

Slide 6: Laws and regulations

On slide:

• Sector laws: HIPAA (business associate agreements), GLBA, PCI DSS
• Privacy laws: state laws, GDPR for EU residents
• Breach notification laws in all 50 states
• CLOUD Act: U.S. government access to data held by U.S. providers

Voice-over: Laws shape what our contracts must include. A health care organization must sign a business associate agreement with any cloud provider that handles protected health information. Privacy laws, including state laws and the European Union’s GDPR, regulate how personal data is processed and transferred, and every U.S. state has a breach notification law with specific deadlines. The CLOUD Act of 2018 allows U.S. law enforcement, with proper legal process, to request data held by U.S.-based providers even when it is stored overseas, which affects where and with whom organizations store sensitive data. The organization remains legally accountable for its data even when a provider holds it.

Slide 7: Moving the perimeter (required figure)

On slide (SmartArt process): Traditional data center perimeter → Users and apps everywhere → Internet as the new network → Identity as the new perimeter

Voice-over: In a traditional network, a firewall protected a defined perimeter around the data center. When applications move to the cloud and employees work remotely, data travels over the public internet, and the old perimeter disappears. This creates two kinds of risk. First, availability: if our internet connection or the provider’s region fails, critical applications become unavailable. Second, exposure: cloud services are reachable from anywhere, so attackers can probe them directly. Security must shift to protecting identities, devices and data wherever they are.

Slide 8: SD-WAN and SASE

On slide:

• SD-WAN: software-defined routing across multiple links
• Improves availability with failover and traffic prioritization
• Risk: direct internet breakout from branches
• SASE: combines SD-WAN with cloud security services

Voice-over: Software-defined wide area networking, or SD-WAN, lets organizations connect branch offices to cloud applications over several links, such as broadband and cellular, and automatically route traffic over the best path. This improves performance and availability. However, sending traffic directly to the internet from each branch removes the central inspection point, so security must travel with the traffic. Secure Access Service Edge, or SASE, combines SD-WAN with cloud-delivered security such as secure web gateways, firewalls and zero trust network access, so policies are enforced consistently wherever users connect.

Slide 9: Identity and access management (IAM)

On slide:

• Single sign-on and federation with the cloud provider
• Phishing-resistant multi-factor authentication
• Least privilege and role-based access
• Protect admin and service accounts; review access regularly

Voice-over: With identity as the new perimeter, IAM is the most important control. Single sign-on and federation let us manage users centrally and remove access quickly when people leave. Multi-factor authentication, ideally phishing-resistant, blocks most credential attacks. Least privilege means each user, application and integration receives only the access it needs, and privileged administrator and service accounts need extra protection and monitoring. Zero Trust architecture, described by NIST, assumes no user or network is trusted by default and verifies each request based on identity, device and context (Rose et al., 2020).

Slide 10: Recommendations

On slide:

• Negotiate liability, audit, notification and exit terms
• Add cyber insurance and vendor risk management
• Map legal obligations before choosing regions
• Adopt SD-WAN/SASE with redundant connectivity
• Make IAM and Zero Trust the foundation

Voice-over: To summarize, organizations should negotiate the strongest contract terms they can, fill remaining gaps with insurance and vendor risk management, understand legal obligations before selecting providers and data locations, design resilient and secure network connections with SD-WAN or SASE, and build security around strong identity and access management. Thank you for listening.

Slide 11: References

Cloud Security Alliance. (2021). Cloud controls matrix v4. https://cloudsecurityalliance.org/research/cloud-controls-matrix

Jansen, W., & Grance, T. (2011). Guidelines on security and privacy in public cloud computing (NIST Special Publication 800-144). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-144

Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207

Clarifying Lawful Overseas Use of Data (CLOUD) Act, H.R. 1625, Division V, 115th Cong. (2018).