What Is Cloud Computing?

Cloud computing is the delivery of computing services — including servers, storage, databases, networking, software, analytics, and intelligence — over the internet (‘the cloud’) to offer faster innovation, flexible resources, and economies of scale. Rather than owning and maintaining physical data centers and servers, organizations can access technology services on an as-needed basis from a cloud provider.

Core Characteristics (NIST SP 800-145)

• On-demand self-service — consumers provision computing capabilities without requiring human interaction with each service provider.
• Broad network access — capabilities are available over the network and accessed through standard mechanisms.
• Resource pooling — provider resources serve multiple consumers using a multi-tenant model.
• Rapid elasticity — capabilities can be elastically provisioned and released to scale with demand.
• Measured service — cloud systems automatically control and optimize resource use by leveraging metering capabilities.

Why Cloud Security Matters

Organizations are migrating critical workloads, intellectual property, and sensitive customer data to cloud environments at an accelerating pace. With this migration comes a fundamental shift in security responsibilities and threat exposure. The 2024 Cloud Security Alliance (CSA) State of Cloud Security report found that 81% of organizations experienced at least one cloud security incident in the prior 12 months, highlighting the critical importance of understanding cloud security models.

Key Security Differences: Cloud vs. On-Premises

Major Cloud Service Providers

Three hyperscalers dominate the global cloud market and each maintains extensive security programs, certifications, and tools:

Infrastructure as a Service (IaaS)

IaaS provides virtualized computing resources over the internet. The provider manages physical hardware, networking, and virtualization. The customer controls operating systems, middleware, runtime, data, and applications.

IaaS Security Responsibilities (Customer)

• Operating system hardening, patching, and lifecycle management
• Network security groups, firewall rules, and virtual network configuration
• Identity and access management for workloads and administrators
• Endpoint protection and anti-malware on virtual machines
• Data encryption at rest and in transit
• Backup, recovery, and business continuity planning

Platform as a Service (PaaS)

PaaS provides a platform allowing customers to develop, run, and manage applications without managing the underlying infrastructure. The provider manages the runtime, middleware, OS, virtualization, servers, storage, and networking.

PaaS Security Responsibilities (Customer)

• Application code security and secure development lifecycle (SDLC)
• Application-level access controls and authentication mechanisms
• Input validation and protection against OWASP Top 10 vulnerabilities
• Secrets management (API keys, connection strings, certificates)
• Data classification and protection within the application

PaaS Security Considerations (Shared)

• Platform API security and service endpoint protection
• Dependency and library vulnerability management
• Logging, monitoring, and alerting integration

Software as a Service (SaaS)

SaaS delivers software applications over the internet, on-demand and typically on a subscription basis. The provider manages the entire stack from infrastructure through the application; the customer primarily manages data, user access, and configuration.

SaaS Security Responsibilities (Customer)

• User provisioning, deprovisioning, and access governance
• Data governance — what data is stored, how it is classified, and retention policies
• Single Sign-On (SSO) and Multi-Factor Authentication (MFA) configuration
• Third-party integration and OAuth permission scoping
• Data Loss Prevention (DLP) policy configuration where available
• Vendor risk assessment and supply chain security review

Shared Responsibility Model

The shared responsibility model is the foundational security framework in cloud computing. It delineates which security obligations belong to the cloud provider and which belong to the customer. Failure to understand this boundary is one of the most significant causes of cloud security incidents.

Identity as the New Perimeter

In traditional IT, the network perimeter (firewalls, DMZs) provided a clear security boundary. Cloud computing dissolves this perimeter — resources are accessed from anywhere, by any device, over the public internet. Identity becomes the primary control plane. Compromised credentials are now the leading initial attack vector in cloud breaches.

Core IAM Concepts

Multi-Factor Authentication (MFA)

MFA requires users to provide two or more verification factors to gain access. It is one of the single most effective controls against credential-based attacks. Industry data consistently shows MFA blocks over 99% of automated account attacks.

MFA Factor Types

• Something you know — password, PIN, security question
• Something you have — hardware token (YubiKey), TOTP app (Google Authenticator, Authy), SMS code
• Something you are — fingerprint, facial recognition, iris scan (biometrics)

Common IAM Misconfigurations

IAM misconfigurations are consistently the leading source of cloud security incidents. The following are the most prevalent:

• Overly permissive policies — use of wildcards (*) in IAM policies granting excessive permissions
  Mitigation: Regular access reviews, AWS IAM Access Analyzer, Azure Permissions Management
• Unused credentials — dormant accounts, old API keys, unused roles still attached to resources
  Mitigation: Credential rotation enforcement, lifecycle management, automated deprovisioning
• Missing MFA on root/administrator accounts
  Mitigation: Enforce MFA via Conditional Access policies or Service Control Policies (SCPs)
• Publicly exposed cloud storage — S3 buckets, Azure Blob containers without ACL controls
  Mitigation: Block public access at the account/organization level, enable CSPM scanning
• Hard-coded credentials in source code or container images
  Mitigation: Secrets management tools (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault)

Top Cloud Security Threats

The Cloud Security Alliance (CSA) Pandemic Eleven identifies the most critical threats facing cloud environments:

Cloud-Specific Attack Techniques

Key Compliance Frameworks

NIST Cybersecurity Framework (CSF) 2.0

The NIST CSF provides a voluntary framework consisting of standards, guidelines, and best practices to manage cybersecurity risk. The 2.0 update adds a Govern function:

• GOVERN — Establish and monitor organizational cybersecurity strategy, expectations, and policy
• IDENTIFY — Develop understanding of systems, assets, data, and risks
• PROTECT — Implement appropriate safeguards to ensure delivery of services
• DETECT — Implement activities to identify cybersecurity events
• RESPOND — Take action regarding detected cybersecurity incidents
• RECOVER — Maintain resilience and restore capabilities affected by incidents

ISO/IEC 27001 & 27017

ISO 27001 is the international standard for Information Security Management Systems (ISMS). ISO 27017 extends 27001 with cloud-specific controls, providing additional guidance on:

• Shared roles and responsibilities between cloud provider and customer
• Removal and return of assets at contract termination
• Protection and separation of virtual environments
• Virtual machine hardening
• Administrative operations and procedures in cloud environments

SOC 2 Type II

SOC 2 is an auditing procedure developed by the AICPA that ensures service providers securely manage data to protect the interests of the organization and the privacy of its clients. Type II reports cover operational effectiveness over a period (typically 6–12 months) across five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

FedRAMP

The Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by U.S. federal agencies. FedRAMP authorizations (Low, Moderate, High) signal the sensitivity level of federal data the system may host.

Compliance Mapping to Cloud Controls

Defense-in-Depth for Cloud

Defense-in-depth applies multiple layers of security controls across the cloud stack, ensuring that a failure in one layer does not lead to a total compromise.

Cloud Security Posture Management (CSPM)

CSPM tools continuously monitor cloud environments for security misconfigurations, compliance violations, and risky exposure. They are a critical component of any mature cloud security program.

Core CSPM Capabilities

• Continuous visibility across multi-cloud environments (AWS, Azure, GCP)
• Automated compliance checking against CIS Benchmarks, NIST, PCI DSS, HIPAA
• Detection and remediation of misconfigured resources (open S3 buckets, exposed ports, public snapshots)
• Security score / cloud security benchmark reporting
• Auto-remediation workflows via Lambda functions, Azure Functions, or playbooks

Data Protection & Encryption

Encryption Key Management

Who controls the encryption keys determines who ultimately controls access to your data. Three key management models exist in cloud:

Cloud Incident Response

Cloud incident response requires significant adaptations from traditional IR processes. Speed of containment is amplified by cloud’s API-driven control plane.

Cloud IR Playbook — Core Steps

• Preparation
  Maintain IR runbooks, pre-authorize response roles, configure CloudTrail/Activity Log retention, test playbooks quarterly
• Detection & Analysis
  Use SIEM/cloud-native detection, triage alerts by severity, preserve logs immediately (logs may auto-expire)
• Containment
  Isolate compromised resources (security group deny-all), revoke IAM credentials, snapshot affected instances for forensics
• Eradication
  Remove malware, terminate unauthorized resources, rotate all potentially exposed credentials, patch vulnerabilities
• Recovery
  Restore from known-good snapshots, verify integrity, re-enable services incrementally, monitor closely
• Post-Incident Activity
  Root cause analysis, lessons learned, update controls and runbooks, report per regulatory requirements

References & Further Reading

• NIST SP 800-145: The NIST Definition of Cloud Computing
• NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing
• NIST Cybersecurity Framework 2.0 — csrc.nist.gov/projects/cybersecurity-framework
• CSA Cloud Controls Matrix (CCM) v4 — cloudsecurityalliance.org
• CSA Top Threats to Cloud Computing: Pandemic Eleven
• ISO/IEC 27001:2022 — Information Security Management Systems
• ISO/IEC 27017:2015 — Code of Practice for Information Security Controls for Cloud Services
• CIS Benchmarks for AWS, Azure, and GCP — cisecurity.org/cis-benchmarks
• MITRE ATT&CK Cloud Matrix — attack.mitre.org/matrices/enterprise/cloud
• FedRAMP Program Documentation — fedramp.gov
• AWS Well-Architected Framework: Security Pillar
• Microsoft Azure Security Benchmark v3
• Google Cloud Security Foundations Guide