Cloud Security 101: Core Concepts for Getting Started
The shared responsibility model, essential cloud security controls, and the most common mistakes organizations make when moving to the cloud.
Last updated Apr 7, 2026Current
Continue your mission
The shared responsibility model, essential cloud security controls, and the most common mistakes organizations make when moving to the cloud.
The single most important concept in cloud security is the shared responsibility model. The cloud provider secures the infrastructure (physical data centers, hypervisors, global network), and you secure everything you put on it (data, identities, applications, configurations).
The dividing line shifts depending on the service model. With Infrastructure as a Service (IaaS), like running VMs on AWS EC2 or Azure VMs, you are responsible for the operating system, middleware, runtime, and application. The provider handles virtualization, storage, networking, and physical security.
With Platform as a Service (PaaS), like Azure App Service or AWS Elastic Beanstalk, the provider also manages the OS and runtime. You focus on your application code and data.
With Software as a Service (SaaS), like Microsoft 365 or Salesforce, the provider handles nearly everything. You are responsible for your data, user access controls, and configuration settings.
Most cloud security failures happen on the customer's side of the responsibility line.
In the cloud, there are no physical firewalls at your office entrance. Identity and access management (IAM) becomes the primary security control. Every action in a cloud environment is an API call authenticated by an identity.
Principle of least privilege is non-negotiable. Grant only the permissions needed for a specific task. Avoid using root or owner accounts for day-to-day operations. Use role-based access control and review permissions regularly.
Multi-factor authentication must be enforced on all human accounts, especially administrative ones. A compromised cloud admin credential without MFA is one of the fastest paths to a full environment takeover.
Service accounts and machine identities need the same rigor. Use short-lived credentials where possible, rotate secrets, and monitor for anomalous usage.
Publicly exposed storage buckets. S3 buckets, Azure Blob containers, and GCS buckets have been the source of countless data breaches. Default configurations have improved, but teams still override them. Block public access at the account level and audit regularly.
Overly permissive security groups. Cloud security groups (virtual firewalls) that allow 0.0.0.0/0 (all IPs) inbound on sensitive ports like SSH (22) or RDP (3389) are an invitation for attackers. Restrict inbound rules to specific IP ranges.
Unencrypted data. Enable encryption at rest for all storage services and databases. Use customer-managed keys when compliance or policy requires it. Ensure TLS encrypts all data in transit.
No logging or monitoring. Enable cloud-native audit logging (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) on day one. Without logs, you cannot detect, investigate, or respond to incidents.
Neglecting infrastructure as code (IaC) security. If you use Terraform, CloudFormation, or Pulumi, misconfigurations in your IaC templates deploy directly to production. Scan IaC templates with tools like Checkov, tfsec, or Trivy before applying them.
Start with these foundational controls: enable MFA everywhere, enforce least-privilege IAM, block public access to storage by default, enable encryption at rest and in transit, turn on audit logging, configure budget and billing alerts (runaway costs can indicate compromise), and implement automated configuration scanning using cloud security posture management (CSPM) tools.
Each major provider offers native security services: AWS has GuardDuty, Security Hub, and Config. Azure has Defender for Cloud, Sentinel, and Policy. GCP has Security Command Center. Third-party tools like Prowler, ScoutSuite, and Wiz provide cross-cloud visibility and deeper analysis.
CDA Theater missions that address topics covered in this article.
Cryptographic technique that encrypts data while preserving its original format and length, enabling protection without breaking legacy system compatibility.
Guide to HTTP/2 security covering binary framing, HPACK compression attacks, rapid reset vulnerability, stream multiplexing risks, and mitigation strategies.
Explanation of Certificate Transparency framework, covering log servers, Signed Certificate Timestamps, monitoring capabilities, and detection of fraudulent certificates.
Written by CDA Wiki Team
Found an issue? Help improve this article.