Skip to main content

​
What is cloud computing?

Cloud computing is using someone else’s computers - servers, storage, and networking - over the internet instead of owning and maintaining your own. Instead of buying a $10,000 server and putting it in your office, you rent computing power from a company like Amazon (AWS), Microsoft (Azure), or Google (GCP) and pay only for what you use.
Over 90% of organizations worldwide use cloud services in some form. Understanding cloud security isn’t optional - it’s a core cybersecurity skill.

​
Why organizations move to the cloud

​
Data centers

Behind every cloud service is a data center - a physical building filled with thousands of servers, storage systems, and networking equipment. These buildings have:
  • Redundant power supplies (generators, battery backups)
  • Advanced cooling systems (servers generate a lot of heat)
  • Physical security (fences, guards, biometric access, security cameras)
  • Redundant network connections (multiple ISPs, fiber links)
AWS cloud data center with rows of illuminated server racks

Cloud data centers like this AWS facility house thousands of servers

Data center with purple and blue lighting on server racks

A modern data center facility - the physical infrastructure behind cloud computing

Major cloud providers like AWS operate data centers in regions around the world. When you choose where your cloud server lives (e.g., “US East” or “Europe West”), you’re choosing which physical data center your data is stored in.

​
Cloud service models

Not all cloud services are the same. The key difference is how much you manage versus how much the provider manages. Think of it as a spectrum from “I do everything” to “they do everything.” We’ll use the Donuts & Dragons donut shop as our example for each model.

​
Traditional / on-premises

Responsibility split: 100% you / 0% provider With on-premises (on-prem) infrastructure, you own and maintain everything. The hardware, the software, the network, the physical building - all of it. Donuts & Dragons example: The shop buys its own POS computer, installs its own payment software, runs its own Wi-Fi router, and stores all transaction data on a hard drive under the counter. If the computer breaks, they fix it. If the software needs an update, they install it. If the hard drive fails, they lose their data.
On-prem means full control but full responsibility. If you don’t patch your own systems, no one will. If your server room floods, that’s your problem.

​
IaaS - Infrastructure as a Service

Responsibility split: ~50% you / ~50% provider The cloud provider gives you the building blocks - virtual servers, storage, and networking. You install your own operating system, your own applications, and manage your own data. Donuts & Dragons example: Instead of buying a physical POS computer, the shop rents a virtual server on AWS EC2. They install their own POS software on it, configure the operating system, and manage security patches. If the software crashes, it’s their problem. If the physical server hardware fails, AWS replaces it automatically. Analogy: Renting an empty kitchen. The landlord provides the building, plumbing, and electricity. You bring your own recipes, ingredients, pots, and pans. Real-world examples: AWS EC2, Microsoft Azure Virtual Machines, Google Compute Engine

​
PaaS - Platform as a Service

Responsibility split: ~10% you / ~90% provider The provider manages the hardware, operating system, runtime environment, and middleware. You focus on writing and deploying your application code and managing your data. Donuts & Dragons example: The shop builds its website and online ordering system on Heroku. They write the code for the website, but Heroku handles the servers, the operating system, security patches, load balancing, and scaling. If 500 people order donuts at once, Heroku automatically adds more capacity. Analogy: A food truck. The truck (engine, tires, kitchen equipment) is provided and maintained for you. You bring your recipes and cook the food. Real-world examples: Heroku, AWS Elastic Beanstalk, Google App Engine, Azure App Service

​
SaaS - Software as a Service

Responsibility split: ~0% you / ~100% provider Everything is managed by the provider. You open a web browser, log in, and use the software. No installation, no servers, no maintenance. Donuts & Dragons example: The shop uses Square as its POS system. Square provides the software, the hardware (card reader), the payment processing, the receipt printing, the inventory tracking, and the data storage. The shop just taps buttons and swipes cards. Analogy: Ordering catering. You don’t cook, you don’t buy ingredients, you don’t wash dishes. The catering company handles everything - you just eat. Real-world examples: Google Workspace, Microsoft 365, Salesforce, Slack, Zoom, Square
Here’s a quick way to remember the models: IaaS gives you the building blocks, PaaS gives you a platform to build on, and SaaS gives you the finished product. As you move from IaaS to SaaS, you give up control but gain convenience.

​
Shared responsibility model

The most critical concept in cloud security is the shared responsibility model. It defines what you are responsible for securing and what your cloud provider is responsible for securing. Getting this wrong is one of the most common causes of cloud security breaches. Organizations assume the cloud provider is handling security, but the provider is only securing their part. Your data and configurations are your responsibility.
Notice that data and identity & access management are always your responsibility - even in SaaS. If you use weak passwords on your Google Workspace account or share files publicly by accident, that’s on you, not Google.

​
Cloud deployment models

Organizations don’t all use the cloud the same way. There are four main deployment models:

Public cloud

Cloud infrastructure owned by a third-party provider and shared among multiple customers. Each customer’s data is isolated, but the underlying hardware is shared.Examples: AWS, Microsoft Azure, Google Cloud PlatformBest for: Most organizations. Cost-effective, scalable, and maintained by experts.

Private cloud

Cloud infrastructure dedicated to a single organization. It can be hosted on-premises or by a third party, but the resources are not shared.Examples: VMware private cloud, OpenStack, AWS GovCloudBest for: Organizations with strict regulatory requirements (government, healthcare, finance).

Hybrid cloud

A mix of on-premises infrastructure and public cloud services, connected together. Sensitive data stays on-prem while less sensitive workloads run in the public cloud.Examples: A bank keeps customer financial data on-prem but runs its public website on AWS.Best for: Organizations transitioning to the cloud gradually, or those with data residency requirements.

Multi-cloud

Using multiple public cloud providers simultaneously. This avoids vendor lock-in and provides redundancy.Examples: Running your website on AWS, your email on Google Workspace, and your data analytics on Azure.Best for: Large organizations that want flexibility and redundancy across providers.

​
SD-WAN

SD-WAN (Software-Defined Wide Area Networking) is a technology that allows organizations to connect multiple locations - offices, stores, data centers - over the internet using software-defined rules instead of expensive dedicated hardware. Donuts & Dragons example: If Donuts & Dragons expands to five locations, SD-WAN lets all five shops connect to the same cloud-based POS system, inventory database, and security cameras through a centralized, software-managed network - without needing a dedicated private network line between each location. Why it matters for security:
  • SD-WAN can encrypt traffic between locations automatically
  • Centralized management means consistent security policies across all sites
  • Traffic can be routed around outages or attacks
  • Security inspection can happen at a central point instead of at each location

​
Security considerations in the cloud

Moving to the cloud doesn’t mean security is someone else’s problem. It changes who is responsible for what, but you still have critical obligations.
What it is: Laws that require data to be stored within a specific country’s borders. For example, the EU’s GDPR may require European citizens’ data to stay within the EU.Why it matters: If you pick a cloud region in the US but serve European customers, you could violate data sovereignty laws. Always know where your cloud provider physically stores your data.
What it is: Industry regulations that dictate how you must handle data. Examples include HIPAA (healthcare), PCI-DSS (payment cards), and SOC 2 (service organizations).Why it matters: Cloud providers offer compliance-ready infrastructure, but you are still responsible for configuring it correctly. A HIPAA-compliant AWS account is only compliant if you set it up properly.
What it is: Controlling who can access your cloud resources and what they can do.Why it matters: Misconfigured access is the #1 cause of cloud breaches. If an intern has admin access to your entire AWS account, one phishing email could compromise everything. Use the principle of least privilege - every user gets only the access they need, nothing more.
What it is: Scrambling data so only authorized parties can read it. In the cloud, you need encryption in two places:
  • In transit: Data is encrypted as it moves between your device and the cloud (HTTPS/TLS)
  • At rest: Data is encrypted while stored on the cloud provider’s servers
Why it matters: If an attacker intercepts traffic or gains access to stored data, encryption ensures they can’t read it without the decryption key.

​
Cloud vs on-prem: The security trade-off

Neither approach is inherently more secure. On-prem gives you full control but requires full expertise. Cloud provides world-class infrastructure but requires you to configure it correctly. Most breaches happen because of misconfiguration, not because the cloud itself is insecure.

​
Key takeaways

  • Cloud computing is using someone else’s servers over the internet instead of owning your own.
  • The shared responsibility model defines who secures what - and data and access management are always your responsibility.
  • IaaS gives you building blocks, PaaS gives you a platform, and SaaS gives you a finished product.
  • Cloud deployment models include public, private, hybrid, and multi-cloud.
  • Security in the cloud requires attention to data sovereignty, compliance, identity management, and encryption.
  • The cloud isn’t inherently more or less secure than on-prem - it depends on how you configure it.