Public cloud is shared computing infrastructure delivered over the internet and operated by a third-party provider. Organizations rent compute, storage, networking, and managed services on demand, while security and identity controls must account for shared responsibility, tenant isolation, access governance, and protection of data, workloads, and non-human identities.
What Public Cloud Means in Security Terms
Public cloud is not just outsourced infrastructure, it is a shared operating model in which the provider runs the underlying platform and the customer governs how data, identities, workloads, and services are used within it. That shift matters because security decisions are split across provider and customer responsibilities.
For practitioners, the most important idea is that public cloud security is shaped by boundaries: tenant separation, control-plane access, service configuration, and the trust placed in internet-reachable management surfaces. Misunderstanding those boundaries is one of the fastest ways to create exposure.
Why Shared Responsibility Changes the Security Model
Public cloud changes who owns which control. The provider typically secures the physical estate, core platform services, and much of the underlying availability layer, while the customer remains responsible for the way cloud resources are configured, who can access them, and what data they hold.
That split is why cloud security issues often arise from misuse rather than provider failure alone. A secure service can still become unsafe if storage is exposed, permissions are too broad, or defaults are left unchanged. NHIMG’s Top 10 Cloud Security Risks is a useful reference for the recurring failure patterns that appear in real deployments.
In practice, public cloud also expands the number of security decisions that must be made quickly, especially when teams consume managed services, automate infrastructure, or allow multiple environments to share the same landing zone.
Identity, Access, and Tenant Isolation in Public Cloud
Public cloud security is deeply shaped by identity governance because most meaningful actions happen through control-plane permissions rather than physical access. Roles, tokens, service identities, and delegated access all determine what a user, workload, or automation process can do.
That is why least privilege and strong authentication are central to cloud risk reduction. Over-privileged access can turn a minor compromise into broad data access or infrastructure control, while weak separation between tenants or environments can collapse isolation assumptions. For the identity side of this model, the Cloud Misconfiguration Guide covers common control failures such as wildcard IAM, static keys, open security groups, and drift.
Public cloud also increases the importance of non-human identities because automation, deployment pipelines, and managed services depend on them. Those identities need the same governance discipline as human access, especially where secrets, tokens, and API permissions are long-lived or reused across environments.
Data Protection, Configuration, and Operational Exposure
Public cloud is especially sensitive to configuration mistakes because many services are designed for rapid self-service. A single exposed storage bucket, permissive security group, or unmanaged snapshot can make otherwise well-built environments visible to outsiders.
Data protection therefore depends on both technical controls and operational hygiene: encryption, key handling, logging, drift detection, policy enforcement, and review of internet exposure. When organisations store regulated or sensitive information in public cloud, the question is not only whether the provider offers controls, but whether those controls are actually enabled and monitored in the customer tenancy.
NHIMG’s ISO/IEC 27018 Cloud PII Protection Guide is relevant when public cloud is used to process personal information, because it frames provider and processor obligations around access to PII, disclosure, and deletion. Public cloud also benefits from the broader control perspective in Microsoft Azure storage exposure 2024, which shows how exposed cloud storage can reveal credentials and configuration material.
How Organisations Assess Public Cloud Risk
Assessing public cloud exposure starts with inventory: what accounts, projects, subscriptions, workloads, storage locations, identities, and managed services exist, and which of them are internet-facing or privileged. Without that baseline, teams cannot tell whether a misconfiguration is isolated or systemic.
It also requires ongoing review of vendor guidance and service-specific security advisories, because public cloud services evolve continuously and the relevant control settings may change with them. Cloud governance is therefore not a one-time deployment task, it is a continuous control-verification problem.
For a broader risk map, the Top 10 Cloud Security Risks is useful because it connects public cloud exposure to the recurring themes of misconfiguration, over-privilege, leaked keys, and logging gaps.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CSA Cloud Controls Matrix and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Public cloud security depends on IAM for access governance and tenant control. |
| Recommendation — Apply IAM controls to enforce least privilege, segregation, and controlled access across cloud tenants. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Public cloud environments rely on account lifecycle control for users and service access. |
| IA-5 — Authenticator Management | Public cloud security depends on protecting and rotating keys, tokens, and other authenticators. | |
| SC-28 — Protection of Information at Rest | Public cloud commonly stores sensitive data that must remain protected in shared infrastructure. | |
| Recommendation — Manage cloud accounts through defined provisioning, review, and disablement processes. Protect, rotate, and retire cloud authenticators to reduce compromise exposure. Encrypt cloud-stored data and enforce protection for sensitive information at rest. | ||
Related resources from NHI Mgmt Group
- How should public sector teams govern hybrid identity security across cloud and on-prem systems?
- What breaks when a public-facing cloud app can execute attacker-controlled code?
- What breaks when secrets are pasted into public cloud development environments?
- How should public-sector teams govern access across legacy systems and cloud services?