Join our Newsletter — 33% off our NHI Course

Cloud Computing Security

Cloud computing security is the set of controls that protects data, workloads, identities, and services running in cloud environments. It combines IAM, encryption, network segmentation, monitoring, configuration hardening, and governance to reduce unauthorized access, misconfiguration, account compromise, and service disruption across shared and distributed infrastructure.

What Cloud Computing Security Covers

Cloud computing security is broader than a single control. It protects the cloud service model itself, including shared infrastructure, managed services, application interfaces, storage, identity layers, and the operating assumptions that sit between the provider and the customer.

Because cloud environments are elastic and highly automated, security has to account for rapid change, multiple trust boundaries, and shared responsibility. A control that is adequate for a static on-premises system may be too weak once workloads, identities, and configuration states can change at machine speed.

Core Control Areas in Cloud Security

The main control families are well understood: identity and access management, encryption, segmentation, logging, hardening, and configuration control. These are the mechanisms that limit who can reach cloud resources, what they can do, and how visible their actions are to defenders.

Identity controls are especially important because cloud access is frequently API-driven and role-based. If identities, tokens, service principals, or access keys are over-permissioned or poorly governed, the cloud environment can be exposed even when the underlying platform is sound.

Configuration is another critical layer. Misconfigured storage, permissive network rules, weak metadata access controls, or overly broad trust policies can turn ordinary cloud features into attack paths. A secure cloud posture depends on continuously checking those settings, not just defining them once.

Why Cloud Environments Create Distinct Security Pressure

Cloud security is not just traditional infrastructure security moved off-site. The attack surface includes control planes, management APIs, temporary credentials, federated identities, third-party integrations, and service-to-service trust relationships that did not exist in the same form in older environments.

This is why cloud incidents often combine several failure modes at once. A single weak identity, a missed hardening control, and a public-facing service can interact to produce unauthorized access, data exposure, or service disruption. The cloud model rewards speed, but speed also magnifies mistakes.

For a concise risk framing, see Top 10 Cloud Security Risks, which covers the recurring patterns practitioners most often have to prevent and investigate.

Security Operations and Governance in Cloud Security

Effective cloud security is continuous, not periodic. Teams need inventory across accounts, subscriptions, projects, workloads, and exposed services, plus monitoring that can detect drift, suspicious access, and changes to privileged roles or security groups.

Governance matters because cloud programs usually span engineering, security, infrastructure, and application teams. Clear ownership is needed for identity lifecycle, logging retention, key management, segmentation policy, and exception handling, otherwise the platform accumulates silent risk over time.

Authoritative control catalogs can help operationalize that governance. NIST SP 800-53 Rev 5 Security and Privacy Controls gives a broad control baseline, while NIST Cybersecurity Framework 2.0 provides a structure for governing, protecting, detecting, responding, and recovering across cloud environments.

Detection, Recovery, and Identity Impact After Exposure

Cloud compromise often leaves a short but dangerous trail: stolen credentials, altered roles, new access keys, unexpected service creation, or logs showing control-plane activity that does not match normal administration. Detection has to look beyond the workload itself and into the management layer.

If an attacker has used cloud access successfully, the response usually has an identity component as well as a technical one. Access keys, tokens, federated sessions, privileged roles, and service accounts may all need review or rotation, because the original compromise may have survived the visible incident.

For that reason, cloud security is closely tied to identity discipline, least privilege, and post-incident trust restoration. Controls such as NIST SP 800-207 Zero Trust Architecture and OWASP API Security Top 10 are useful because they focus attention on verification, authorization, and service-interface abuse in cloud-native environments.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST CSF 2.0 GV.OC-03 — Roles, Responsibilities, and Authorities Cloud security depends on clear accountability across shared responsibility boundaries.
PR.AA-05 — Network Integrity Is Protected Cloud segmentation and trust-boundary control are central to reducing lateral exposure.
DE.CM-09 — Cybersecurity Event Detection Cloud control-plane and workload monitoring are essential for spotting misuse and drift.
Recommendation — Assign explicit cloud security ownership for configuration, identity, logging, and recovery decisions. Enforce segmented cloud trust zones and restrict east-west access paths. Monitor cloud control-plane, identity, and workload activity for anomalous changes.
NIST SP 800-53 Rev 5 AC-2 — Account Management Cloud security requires governance over user, service, and privileged account lifecycle.
Recommendation — Review and revoke cloud accounts, roles, and access paths on a defined schedule.
OWASP API Security Top 10 API8 — Security Misconfiguration Cloud-native services are commonly exposed through misconfiguration of APIs and interfaces.
API2 — Broken Authentication Cloud control planes and service APIs often rely on tokens, federated auth, and keys.
API5 — Broken Function Level Authorization Cloud platforms often expose privileged actions through APIs that need strict authorization.
Recommendation — Harden cloud-facing APIs and service settings to remove insecure defaults and exposure. Verify strong authentication for cloud APIs and invalidate compromised credentials quickly. Restrict privileged cloud actions to explicitly authorised roles and functions.
OWASP Non-Human Identity Top 10 NHI-05 — Overprivileged NHI Cloud workloads, service accounts, and automation often carry excessive permissions.
NHI-06 — Insecure Cloud Deployment Configurations This maps directly to insecure cloud setup, public exposure, and weak defaults.
NHI-07 — Long-Lived Secrets Cloud access often depends on secrets that persist too long and are hard to govern.
Recommendation — Reduce cloud workload and service identity privileges to the minimum required. Continuously check cloud configurations for public exposure, weak policies, and drift. Replace long-lived cloud secrets with shorter-lived credentials and tighter rotation.