The Cloud Is Different

The Cloud Is Different

The cloud isn't just "someone else's computers." It changes how security works.

What Changed

You control less. The cloud provider (AWS, Azure, Google Cloud) manages:

• The physical servers
• The network infrastructure
• The operating system
• Updates and patches

You manage:

• Your code
• Your configuration
• Your access controls
• Your data

Misconfiguration is the #1 risk. On-premises, things are often locked down by default. In the cloud, you have to explicitly configure security.

Everyone can see your mistakes. A misconfigured S3 bucket or database can be publicly accessible to the internet.

The Shared Responsibility Model

This is the most important concept.

Cloud Provider's Job:

• Secure the infrastructure (hardware, network, data centers)
• Encrypt data in transit between their systems
• Provide security tools and controls

Your Job:

• Configure those tools correctly
• Manage your own encryption keys and data
• Control who can access your resources
• Secure your application code

If there's a breach, it's either:

• Their infrastructure (rare, not your fault)
• Your misconfiguration (common, your fault)

Three Major Cloud Risks

1. Misconfigured Access:

• Databases that allow anyone to connect
• S3 buckets with public read access
• APIs without authentication
• Storage with wrong permissions

1. Exposed Secrets:

• API keys in code or config
• Credentials in logs
• Secrets in version control
• Plaintext passwords in environment variables

1. Unencrypted Data:

• Data in storage without encryption
• Data in transit without encryption
• Backups without encryption
• Data at rest with default (shared) keys instead of your own keys