What is cloud security?

Cloud computing is a method of storing data, infrastructure, and applications over the internet. Cloud security is a means of safeguarding the cloud against attacks, both external and internal. It is typically governed by a series of controls, procedures, and policies that work in tandem to protect all assets within the cloud--these protocols, when implemented, can also assist in regulatory compliance and reduced administrative overhead.

• Internal private cloud: utilised by internal staff that operate the virtual environment.
• Public cloud provider private cloud: A third party provides the computing environment with one environment serving a customer.
• Public cloud: Software-as-a-service (SaaS), infrastructure-as-a-service (IaaS), and platform-as-a-service (PaaS).
• Hybrid cloud: Private and public cloud systems are shared by both public and private providers, divided up based on cost, overhead, and workloads.

Public clouds, while generally secure, don’t have the same isolation factor as private clouds. They are multi tenancy, meaning that a company can rent server space from a system that also houses other tenants with their own server space. The hosting company usually oversees security measures and ensures that each company has the appropriate amount of privacy.

But the multi tenancy factor can pose its own threat. If another tenant lets in something harmful or acts carelessly, attacks like distributed denial-of-service (DDoS) attacks can spread.

Encryption and security are applied to different workloads at different levels according to different demands. Hybrid clouds provide the ability to better mitigate risk—the combination of two cloud environments allows for diversification and the choice to place workloads in certain places depending on different requirements. For example, more sensitive workloads and data can be stored in a private cloud, and more standard workloads can be placed in a public cloud. While there are difficulties like a larger attack surface and data migration, diversifying with a hybrid cloud is a great way to mitigate security risks.

Granular, policy-based IAM and authentication controls across complex infrastructures
It’s advisable to work within groups and roles rather than working at an individual identity and access management level. Groups and roles can make it easier to update business requirements and rules—the principles of least privilege are ideally applied to each group or role. Good identity and access management hygiene has strong password policies and permission time-outs.

Zero-trust cloud network security controls across logically isolated networks and micro-segments
Logically isolate resources within a cloud’s network, and micro-segment resources using subnets to set a security policy at a subnet level. Use static user-defined configurations and a dedicated WAN to customise access for users.

Enforcement of virtual server protection policies and processes such as change management and software updates
Cloud vendors consistently apply compliance rules when setting up a virtual server.

Safeguarding all applications (and especially cloud-native distributed apps) with a next-generation web application firewall
Granular inspection and traffic control of servers, automatic updates of WAF rules, and microservices that run workloads.

Enhanced data protection
Encryption at all transport layers, continuous risk management, secure communications, and maintaining data storage hygiene.

Threat intelligence that detects and remediates known and unknown threats in real time
Cloud vendors cross-reference aggregated log data with internal data and external data to add context to diverse streams of native logs. There are also AI anomaly detection systems that can catch threats for forensic analyses to determine the level of threat. Real-time alerts can visualise a threat landscape for quicker response times.

• SaaS: Customers are meant to secure their own data and user access.
• PaaS: Customers secure their own data, user access, and applications.
• IaaS: Customers secure their data, user access, operation systems, virtual network traffic, and applications.