Cloud Security and Shared Responsibility

Introduction

Cloud providers spend a great deal on security, but your data can still be exposed if you set things up carelessly. The key idea is that security is a team effort.

The simple explanation

The provider secures the cloud itself. You secure what you put in it and how you use it.

This is called the shared responsibility model. Think of renting a flat. The landlord looks after the building, the main door and the wiring. You are responsible for locking your own door and who you give keys to.

• The provider: physical data centres, hardware, and the core network.
• You: your accounts and passwords, who can access what, how your data and apps are configured, and (for IaaS) operating system updates.

Exactly where the line sits depends on the service type. With SaaS, you manage less. With IaaS, you manage more.

Common mistakes

• Public storage by accident. A storage bucket set to public can expose private files.
• Weak or shared logins and no two-step sign-in.
• Too much access. Giving everyone full admin rights.
• Secrets in code. Keys and passwords published in a public repository.
• Not updating software on servers you manage.

First steps for a new account

1. Turn on two-step sign-in, especially for the owner account.
2. Give people the least access they need, nothing more.
3. Keep keys and secrets out of your code. Use the platform's secret storage.
4. Set budget alerts to spot misuse.
5. Turn on logging so you can see who did what.
6. Keep backups and test that you can restore them.

Try it yourself

Imagine you run a small shop's website in the cloud. Write down which three of the first steps matter most to you, and why.

Summary

• The provider secures the cloud, and you secure what you put in it.
• Most cloud breaches come from settings and access mistakes, not broken buildings.
• Use two-step sign-in, least access, hidden secrets and logging from day one.