The cloud (cloud computing) is on-demand access over the internet to servers, storage, databases and software that a provider operates and bills by usage.
How cloud computing works
The US standards body NIST defines cloud computing by five features: on-demand self-service, broad network access, shared resource pools, rapid elasticity and measured service. Services are usually grouped into three models:
- IaaS (infrastructure as a service) – virtual machines, networks and storage, for example AWS EC2 or Azure VMs;
- PaaS (platform as a service) – managed databases, containers and serverless functions;
- SaaS (software as a service) – ready applications such as Microsoft 365, Google Workspace or Salesforce.
Clouds can be public, private (run for one organisation) or hybrid.
Why the cloud matters for security
Cloud providers follow a shared responsibility model: they secure the data centres and platform, while customers remain responsible for identities, configuration and data. Most cloud breaches happen on the customer side:
- misconfigurations such as publicly readable storage buckets or open databases;
- stolen credentials and missing MFA – in 2024 attackers used passwords stolen by infostealers to access Snowflake customer accounts of large companies;
- leaked access keys in code and over-privileged service accounts;
- attacks on management consoles and APIs.
Best practices
- Enforce MFA for every user and remove long-lived access keys.
- Grant least privilege and review permissions regularly.
- Scan configurations continuously (CSPM) and enable logging such as CloudTrail or Azure Monitor.
- Encrypt data and keep backups outside the main cloud account.
Synonyms:
cloud computing, cloud services
