Cloud Security Basics: Shared Responsibility and Best Practices
Cloud platforms are secure by default in many ways, but most cloud breaches are not the provider’s fault. They come from customer misconfigurations: an exposed storage bucket, an over-permissioned account, a missing MFA. Understanding who is responsible for what is the foundation of cloud security.
The shared responsibility model
In the cloud, security is split. The provider secures the underlying infrastructure, the data centers, hardware, and core services. You, the customer, are responsible for how you configure and use those services: your data, access controls, and settings. Breaches usually happen on the customer side.
Common cloud risks
Most cloud incidents trace back to a short list of mistakes:
- Misconfigured storage left open to the public internet.
- Weak or missing identity and access management (IAM), and no MFA.
- Over-permissioned accounts that can do far more than they need.
- Secrets and API keys committed to code or left in plain text.
- No monitoring, so a breach goes unnoticed for weeks.
Cloud security best practices
A few fundamentals prevent most problems:
- Enforce MFA and least-privilege access for every account.
- Encrypt data at rest and in transit.
- Review and lock down public access to storage and databases.
- Manage secrets with a vault, never hard-code them.
- Turn on logging and alerting so you can detect and respond.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
The bucket that was public for two years
A marketing contractor spun up a cloud storage bucket for a campaign and set it to public so a vendor could grab files quickly. The campaign ended; the bucket stayed. Two years later a security researcher, using tools that scan for open buckets, found 3 million customer records in it: names, emails, and order histories.
There was no hack. No password was cracked and no malware was deployed. The data was simply sitting on the public internet, waiting to be indexed.
- Misconfiguration, not hacking, causes most cloud breaches. "Public" in the cloud means the entire internet. One checkbox can be the whole breach.
- Temporary settings become permanent. Shortcuts outlive projects. Review and expire access when work ends, and prefer expiring share links over public buckets.
- You cannot secure what you cannot see. Cloud providers ship free tools that flag public buckets and risky settings. Turning them on costs nothing; not turning them on cost 3 million records.
Test yourself
Check your cloud security knowledge, free.
Frequently asked questions
Who is responsible for cloud security?
Both you and your provider, under the shared responsibility model. The provider secures the infrastructure; you secure your data, access, and configuration. Most breaches happen on the customer side.
What causes most cloud breaches?
Misconfiguration, especially publicly exposed storage and weak identity controls, rather than flaws in the cloud platform itself.
Is data in the cloud automatically encrypted?
Often it can be, but you usually have to enable and configure encryption correctly. Do not assume it is on, verify encryption for data at rest and in transit.