Cloud Security Fundamentals

Cloud security operates under a shared responsibility model — the provider secures the underlying infrastructure, while the customer remains responsible for securing what they build and configure on top of it.

The Shared Responsibility Model

Cloud providers secure the physical data centres, hardware, and the underlying virtualization layer ("security OF the cloud"). Customers remain responsible for securing their own data, access controls, application configuration, and network settings ("security IN the cloud") — this division of responsibility shifts depending on the service model (IaaS, PaaS, or SaaS).

Core Security Practices

A handful of foundational practices address the majority of real-world cloud security incidents, most of which stem from customer misconfiguration rather than a failure of the provider's own infrastructure.

• Encrypt sensitive data both at rest and in transit.
• Follow the principle of least privilege for every access permission granted.
• Never leave storage buckets or databases publicly accessible unless genuinely required.
• Enable logging and monitoring to detect unusual activity quickly.

Common Mistakes

• Assuming the cloud provider is entirely responsible for security, when customer-side misconfiguration is the leading cause of most real-world cloud security incidents.
• Leaving storage buckets or databases publicly accessible by mistake, exposing sensitive data to anyone on the internet.
• Granting overly broad permissions to users or applications "to make things easier", violating the principle of least privilege.
• Not enabling logging or monitoring, leaving a security incident undetected for far longer than necessary.