> ## Documentation Index
> Fetch the complete documentation index at: https://stem-docs.intellectualpoint.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Cloud security
> Compare cloud service models and understand the shared responsibility for securing them.
## What is cloud computing?
Cloud computing is using someone else's computers - servers, storage, and networking - over the internet instead of owning and maintaining your own. Instead of buying a \$10,000 server and putting it in your office, you rent computing power from a company like Amazon (AWS), Microsoft (Azure), or Google (GCP) and pay only for what you use.
Over 90% of organizations worldwide use cloud services in some form. Understanding cloud security isn't optional - it's a core cybersecurity skill.
### Why organizations move to the cloud
| Reason | Explanation |
| --------------------- | ------------------------------------------------------------------------------------------------------- |
| **Cost savings** | No upfront hardware costs. Pay monthly for what you use instead of buying expensive servers. |
| **Scalability** | Need more power during Black Friday sales? Scale up in minutes. Quiet month? Scale back down. |
| **Reliability** | Cloud providers operate multiple data centers. If one goes down, your data is safe in another. |
| **Accessibility** | Your team can access systems from anywhere with an internet connection - no VPN to the office required. |
| **Automatic updates** | The provider handles hardware maintenance, security patches, and infrastructure upgrades. |
### Data centers
Behind every cloud service is a **data center** - a physical building filled with thousands of servers, storage systems, and networking equipment. These buildings have:
* **Redundant power supplies** (generators, battery backups)
* **Advanced cooling systems** (servers generate a lot of heat)
* **Physical security** (fences, guards, biometric access, security cameras)
* **Redundant network connections** (multiple ISPs, fiber links)
Major cloud providers like AWS operate data centers in **regions** around the world. When you choose where your cloud server lives (e.g., "US East" or "Europe West"), you're choosing which physical data center your data is stored in.
## Cloud service models
Not all cloud services are the same. The key difference is **how much you manage versus how much the provider manages**. Think of it as a spectrum from "I do everything" to "they do everything."
We'll use the **Donuts & Dragons** donut shop as our example for each model.
### Traditional / on-premises
**Responsibility split: 100% you / 0% provider**
With on-premises (on-prem) infrastructure, you own and maintain everything. The hardware, the software, the network, the physical building - all of it.
**Donuts & Dragons example:** The shop buys its own POS computer, installs its own payment software, runs its own Wi-Fi router, and stores all transaction data on a hard drive under the counter. If the computer breaks, they fix it. If the software needs an update, they install it. If the hard drive fails, they lose their data.
On-prem means full control but full responsibility. If you don't patch your own systems, no one will. If your server room floods, that's your problem.
### IaaS - Infrastructure as a Service
**Responsibility split: \~50% you / \~50% provider**
The cloud provider gives you the building blocks - virtual servers, storage, and networking. You install your own operating system, your own applications, and manage your own data.
**Donuts & Dragons example:** Instead of buying a physical POS computer, the shop rents a virtual server on AWS EC2. They install their own POS software on it, configure the operating system, and manage security patches. If the software crashes, it's their problem. If the physical server hardware fails, AWS replaces it automatically.
**Analogy:** Renting an empty kitchen. The landlord provides the building, plumbing, and electricity. You bring your own recipes, ingredients, pots, and pans.
**Real-world examples:** AWS EC2, Microsoft Azure Virtual Machines, Google Compute Engine
### PaaS - Platform as a Service
**Responsibility split: \~10% you / \~90% provider**
The provider manages the hardware, operating system, runtime environment, and middleware. You focus on writing and deploying your application code and managing your data.
**Donuts & Dragons example:** The shop builds its website and online ordering system on Heroku. They write the code for the website, but Heroku handles the servers, the operating system, security patches, load balancing, and scaling. If 500 people order donuts at once, Heroku automatically adds more capacity.
**Analogy:** A food truck. The truck (engine, tires, kitchen equipment) is provided and maintained for you. You bring your recipes and cook the food.
**Real-world examples:** Heroku, AWS Elastic Beanstalk, Google App Engine, Azure App Service
### SaaS - Software as a Service
**Responsibility split: \~0% you / \~100% provider**
Everything is managed by the provider. You open a web browser, log in, and use the software. No installation, no servers, no maintenance.
**Donuts & Dragons example:** The shop uses **Square** as its POS system. Square provides the software, the hardware (card reader), the payment processing, the receipt printing, the inventory tracking, and the data storage. The shop just taps buttons and swipes cards.
**Analogy:** Ordering catering. You don't cook, you don't buy ingredients, you don't wash dishes. The catering company handles everything - you just eat.
**Real-world examples:** Google Workspace, Microsoft 365, Salesforce, Slack, Zoom, Square
Here's a quick way to remember the models: **IaaS** gives you the building blocks, **PaaS** gives you a platform to build on, and **SaaS** gives you the finished product. As you move from IaaS to SaaS, you give up control but gain convenience.
## Shared responsibility model
The most critical concept in cloud security is the **shared responsibility model**. It defines what you are responsible for securing and what your cloud provider is responsible for securing.
Getting this wrong is one of the most common causes of cloud security breaches. Organizations assume the cloud provider is handling security, but the provider is only securing their part. Your data and configurations are your responsibility.
| Component | On-prem | IaaS | PaaS | SaaS |
| -------------------------------- | ------- | -------- | -------- | -------- |
| **Physical data center** | You | Provider | Provider | Provider |
| **Networking** | You | Provider | Provider | Provider |
| **Storage hardware** | You | Provider | Provider | Provider |
| **Hypervisor / virtualization** | You | Provider | Provider | Provider |
| **Operating system** | You | You | Provider | Provider |
| **Middleware / runtime** | You | You | Provider | Provider |
| **Applications** | You | You | You | Provider |
| **Data** | You | You | You | You\* |
| **Identity & access management** | You | You | You | You |
Notice that **data** and **identity & access management** are always your responsibility - even in SaaS. If you use weak passwords on your Google Workspace account or share files publicly by accident, that's on you, not Google.
## Cloud deployment models
Organizations don't all use the cloud the same way. There are four main deployment models:
Cloud infrastructure owned by a third-party provider and shared among multiple customers. Each customer's data is isolated, but the underlying hardware is shared.
**Examples:** AWS, Microsoft Azure, Google Cloud Platform
**Best for:** Most organizations. Cost-effective, scalable, and maintained by experts.
Cloud infrastructure dedicated to a single organization. It can be hosted on-premises or by a third party, but the resources are not shared.
**Examples:** VMware private cloud, OpenStack, AWS GovCloud
**Best for:** Organizations with strict regulatory requirements (government, healthcare, finance).
A mix of on-premises infrastructure and public cloud services, connected together. Sensitive data stays on-prem while less sensitive workloads run in the public cloud.
**Examples:** A bank keeps customer financial data on-prem but runs its public website on AWS.
**Best for:** Organizations transitioning to the cloud gradually, or those with data residency requirements.
Using multiple public cloud providers simultaneously. This avoids vendor lock-in and provides redundancy.
**Examples:** Running your website on AWS, your email on Google Workspace, and your data analytics on Azure.
**Best for:** Large organizations that want flexibility and redundancy across providers.
## SD-WAN
**SD-WAN** (Software-Defined Wide Area Networking) is a technology that allows organizations to connect multiple locations - offices, stores, data centers - over the internet using software-defined rules instead of expensive dedicated hardware.
**Donuts & Dragons example:** If Donuts & Dragons expands to five locations, SD-WAN lets all five shops connect to the same cloud-based POS system, inventory database, and security cameras through a centralized, software-managed network - without needing a dedicated private network line between each location.
**Why it matters for security:**
* SD-WAN can encrypt traffic between locations automatically
* Centralized management means consistent security policies across all sites
* Traffic can be routed around outages or attacks
* Security inspection can happen at a central point instead of at each location
## Security considerations in the cloud
Moving to the cloud doesn't mean security is someone else's problem. It changes *who* is responsible for *what*, but you still have critical obligations.
**What it is:** Laws that require data to be stored within a specific country's borders. For example, the EU's GDPR may require European citizens' data to stay within the EU.
**Why it matters:** If you pick a cloud region in the US but serve European customers, you could violate data sovereignty laws. Always know where your cloud provider physically stores your data.
**What it is:** Industry regulations that dictate how you must handle data. Examples include HIPAA (healthcare), PCI-DSS (payment cards), and SOC 2 (service organizations).
**Why it matters:** Cloud providers offer compliance-ready infrastructure, but you are still responsible for configuring it correctly. A HIPAA-compliant AWS account is only compliant if you set it up properly.
**What it is:** Controlling who can access your cloud resources and what they can do.
**Why it matters:** Misconfigured access is the #1 cause of cloud breaches. If an intern has admin access to your entire AWS account, one phishing email could compromise everything. Use the principle of least privilege - every user gets only the access they need, nothing more.
**What it is:** Scrambling data so only authorized parties can read it. In the cloud, you need encryption in two places:
* **In transit:** Data is encrypted as it moves between your device and the cloud (HTTPS/TLS)
* **At rest:** Data is encrypted while stored on the cloud provider's servers
**Why it matters:** If an attacker intercepts traffic or gains access to stored data, encryption ensures they can't read it without the decryption key.
## Cloud vs on-prem: The security trade-off
| Factor | On-prem | Cloud |
| ---------------------- | ---------------------------------------------- | ----------------------------------------------------- |
| **Physical security** | Your responsibility entirely | World-class data center security by the provider |
| **Patching & updates** | You do it (and often forget) | Provider handles infrastructure; you handle your apps |
| **Scalability** | Buy new hardware (weeks/months) | Click a button (minutes) |
| **Cost** | High upfront capital expense | Pay-as-you-go operational expense |
| **Expertise required** | You need to hire/train IT staff for everything | Provider handles infrastructure expertise |
| **Data control** | Complete control over where data lives | Must trust the provider and verify configurations |
Neither approach is inherently more secure. On-prem gives you full control but requires full expertise. Cloud provides world-class infrastructure but requires you to configure it correctly. Most breaches happen because of **misconfiguration**, not because the cloud itself is insecure.
## Key takeaways
* **Cloud computing** is using someone else's servers over the internet instead of owning your own.
* The **shared responsibility model** defines who secures what - and data and access management are always your responsibility.
* **IaaS** gives you building blocks, **PaaS** gives you a platform, and **SaaS** gives you a finished product.
* Cloud deployment models include **public**, **private**, **hybrid**, and **multi-cloud**.
* Security in the cloud requires attention to **data sovereignty**, **compliance**, **identity management**, and **encryption**.
* The cloud isn't inherently more or less secure than on-prem - it depends on how you configure it.