Cloud computing security

Cloud computing security is built on the shared responsibility model, which delineates security duties between the cloud provider and the customer. Providers like AWS, Azure, and Google Cloud secure the physical infrastructure, hypervisors, and foundational services, while customers are responsible for securing their data, identities, and configurations within the cloud. This division varies by service model: in IaaS, customers manage more, while in SaaS, the provider handles most security. Misunderstanding this model is a leading cause of breaches, as customers often assume providers protect more than they do.

Key security domains include identity and access management (IAM), data encryption, network security, and compliance. IAM ensures that only authorized users access resources, often through multi-factor authentication and least-privilege principles. Data protection involves encrypting data at rest and in transit, using key management services. Network security employs firewalls, virtual private clouds, and security groups to control traffic. Compliance frameworks like GDPR, HIPAA, and PCI DSS require specific controls, and cloud providers offer compliance certifications to aid customers in meeting regulatory obligations.

Cloud environments face a unique set of threats, including data breaches, misconfiguration, insecure APIs, and account hijacking. Misconfiguration is particularly prevalent, with cloud storage buckets left publicly accessible due to human error, exposing sensitive data. Insecure APIs are another critical vector, as they are the primary interface for cloud services and can be exploited if not properly secured. Account hijacking, often via phishing or credential stuffing, allows attackers to gain unauthorized access to cloud consoles and data.¹

Advanced persistent threats (APTs) and insider threats also pose significant risks. APTs may target cloud infrastructure to steal intellectual property, while insiders—whether malicious or negligent—can cause data leaks. The shared nature of cloud resources introduces risks of cross-tenant attacks, though providers implement isolation mechanisms. Additionally, supply chain attacks, where third-party software or services are compromised, can affect cloud environments. The 2020 SolarWinds attack demonstrated how a single compromised vendor could impact numerous cloud customers.²

Effective cloud security relies on a defense-in-depth strategy that layers multiple controls. Identity and access management (IAM) is foundational, with policies enforcing least privilege and regular access reviews. Multi-factor authentication is mandatory for all users, especially administrators. Data encryption should be applied universally, with customer-managed keys for sensitive workloads. Network segmentation, using virtual private clouds and subnets, limits lateral movement. Continuous monitoring and logging, via services like AWS CloudTrail or Azure Monitor, enable threat detection and incident response.

Automation and infrastructure-as-code (IaC) help prevent misconfigurations by codifying security policies. Tools like Terraform and AWS Config can enforce compliance automatically. Zero-trust architecture, which assumes no implicit trust, is increasingly adopted, requiring verification for every access request. Regular security assessments, including penetration testing and vulnerability scanning, are essential. Organizations should also develop incident response plans tailored to cloud environments, including data backup and disaster recovery strategies.

Beyond mainstream practices, cloud security has niche dimensions. One is the role of confidential computing, which encrypts data in use using hardware-based trusted execution environments (TEEs), protecting against even privileged insiders. Another is the security implications of serverless computing, where functions are ephemeral and require different monitoring approaches. The concept of 'cloud security posture management' (CSPM) has emerged to automatically detect and remediate misconfigurations across multi-cloud environments.³

Historically, the 2011 Sony PlayStation Network breach, though not cloud-specific, highlighted risks of third-party data storage. More recently, the 2021 'Log4Shell' vulnerability in the Log4j library affected numerous cloud services, underscoring supply chain risks. Additionally, the legal aspect of data sovereignty—where data must reside in specific jurisdictions—adds complexity to cloud security. The 'right to be forgotten' under GDPR forces organizations to ensure data deletion in cloud backups, a challenging task. These edge cases illustrate that cloud security is not just technical but also legal and operational.

Shared responsibility model

A framework dividing security duties between cloud provider and customer.

IAM

Identity and Access Management; controls user access to resources.

Zero-trust

Security model requiring verification for every access request.

CSPM

Cloud Security Posture Management; automated detection of misconfigurations.

TEE

Trusted Execution Environment; hardware-based encryption for data in use.