Cloud Security.

What is cloud security?

Cloud security is the work of protecting the data, applications and systems that run in cloud computing. It covers the choices an organization makes when it uses cloud services, and the risks that come with them.

The NIST glossary describes cloud computing as a model for on-demand network access to a shared pool of configurable computing resources, such as networks, servers, storage, applications and services. Cloud security is about keeping those resources safe.

Why does moving to the cloud change security?

NIST SP 800-144 says the publication gives an overview of the security and privacy challenges of public cloud computing. It also points out considerations organizations should take when outsourcing data, applications and infrastructure to a public cloud environment.

In plain terms, some of an organization’s data and services sit outside its own walls. That is why the security work has to be planned on purpose.

What are the common cloud security risks?

OWASP, an open community focused on software security, keeps a Cloud-Native Application Security Top 10 project. It covers risks that come from containers, microservices and modern cloud deployment. A container is a packaged unit of software that runs the same way in different places. A microservice is a small part of an application that does one job. The OWASP list names these risks:

• Insecure cloud, container or orchestration configuration
• Injection flaws, in the application layer, cloud events and cloud services
• Improper authentication and authorization
• Flaws in the CI/CD pipeline and software supply chain
• Insecure secrets storage
• Over-permissive or insecure network policies
• Using components with known vulnerabilities
• Improper assets management
• Inadequate compute resource quota limits
• Ineffective logging and monitoring, for example of runtime activity

What does a cloud security problem look like?

This is a simple illustration, not a real case. A team puts files in an online storage service and leaves a setting more open than it should be. That fits the first item on the OWASP list, insecure configuration.

How can organizations reduce cloud security risks?

OWASP says its project aims to help organizations adopt cloud-native technologies securely by identifying the most prominent risks and ways to reduce them. The ten items above give a practical list of areas to review. NIST asks organizations to consider the security and privacy challenges before they outsource data, applications and infrastructure to a public cloud.

How does cloud security relate to nearby terms?

An organization’s cloud services are part of its attack surface, the set of points where an attacker could try to get in. Third-party risk covers the risks that come from outside providers. See these terms for more detail.

Is cloud security the same as cloud computing?

No. Cloud computing is the model of using shared, on-demand computing resources over a network. Cloud security is the practice of protecting what runs there.

Does cloud security only apply to public clouds?

NIST SP 800-144 focuses on public cloud computing. The OWASP project looks at cloud-native applications more broadly. Both treat the cloud as something that needs its own security attention.

Does moving to the cloud end the security work?

Not according to the sources above. NIST describes considerations organizations should take when outsourcing to the cloud, and OWASP lists risks such as configuration, access and monitoring that organizations can review.

Brandefense monitors an organization’s external attack surface, which can include its internet-facing cloud assets.