Cloud security is the set of controls, tools, policies and practices that protect data, applications, user accounts and infrastructure running in cloud services, from infrastructure platforms such as AWS, Microsoft Azure and Google Cloud to SaaS applications such as Microsoft 365 and Salesforce. It is not a single product. It is the cloud-specific part of an organization’s overall security program, built around the fact that the cloud provider and the customer each secure different layers.
At a glance
- Security in the cloud is shared: the provider secures its infrastructure, and you secure your accounts, configuration and data.
- Where that line sits depends on the service type; you manage more on infrastructure services than on SaaS.
- Misconfiguration and compromised accounts are common causes of cloud security incidents.
- Identity and access control is central, because in the cloud a stolen login can reach everything that login can reach.
- Native platform controls cover a lot when enabled; many companies add tools for visibility across multiple clouds and apps.
What problem it solves
Moving to the cloud removes a lot of work: no servers to rack, no hardware to patch. It does not remove security responsibility, and it changes where the risks sit. In a data center, much of the protection came from the network boundary. In the cloud, the management consoles and APIs are reachable from the internet, many services have public endpoints by default, and whether workloads are exposed depends on how they are built and configured (private networking, private endpoints and access restrictions can keep them off the internet). Settings can be changed in seconds by anyone with the right permissions, and a single misconfigured storage bucket or an administrator account without multi-factor authentication can expose data publicly.
Mid-sized companies often use one or two infrastructure clouds plus dozens of SaaS applications, each with its own settings, admin accounts and logs. Cloud security gives that sprawl a structure: who can access what, how settings are checked, where activity is logged and who watches it.
How it works
Shared responsibility. Under the shared responsibility model, providers publish what they secure and what the customer must secure. For Software as a Service (SaaS), you mainly own users, data and settings; for infrastructure services, you also own operating systems, network rules and application code. Getting this boundary right is the first step.
Identity and access. Identity and access management (IAM) controls who can sign in and what they can do. Strong authentication, least-privilege roles, separate admin accounts and removing access promptly when people leave do much of the work.
Configuration management. Cloud security posture management (CSPM) tools continuously check cloud settings against best practices and compliance rules and flag public storage, open ports or missing encryption.
SaaS visibility and control. A cloud access security broker (CASB) shows which cloud apps people use and can enforce policies on access and data movement.
Data protection, logging and response. Encryption, backups of cloud and SaaS data, central logging and monitoring, and an incident response plan that covers cloud accounts complete the picture. Workload protection tools extend endpoint-style detection to cloud servers and containers.
How these fit together depends on your mix of public, private and hybrid cloud and on how much of your cloud computing runs as SaaS versus infrastructure you manage.
When it matters for buyers
- During a cloud migration. Security design is cheaper to get right before workloads move than after.
- When adding a second cloud or many SaaS apps. Each brings its own settings and admin model, and gaps appear between them.
- When auditors, customers or insurers ask. Questionnaires increasingly ask about cloud configuration, MFA and logging.
- After a misconfiguration scare. A public bucket or exposed key is often the prompt to add continuous checks.
Our public cloud overview covers how providers and partners divide this work.
Questions to ask vendors
- What exactly do you secure, and what remains our responsibility under your service?
- Which native security features are included, and which require a higher tier or extra cost?
- How do you detect and alert on risky configuration changes?
- Can your tool cover all our clouds and key SaaS apps, or only one platform?
- What logs do we get, how long are they kept, and can we send them to our own monitoring?
- How is our data backed up, and can we restore it ourselves after accidental deletion or ransomware?
- Who responds if you detect suspicious activity in our account, and how quickly do we hear about it?
How it differs from cloud security posture management (CSPM)
Cloud security is the whole discipline of protecting what you run in the cloud: identity, configuration, data, workloads, monitoring and response. CSPM is one category of tool within it, focused on continuously checking cloud platform settings for misconfigurations and compliance gaps. A company can have CSPM and still be exposed through weak authentication, unprotected SaaS data or nobody watching alerts, so CSPM is a useful part of cloud security, not a substitute for it.