Cloud-Based Services

Cloud-Based Services and Shared Responsibility

Cloud-based services shift many core functions, including storage, compute and application delivery, from local systems to a provider-operated platform. That changes where security responsibility sits: the provider secures the underlying infrastructure, while the customer still governs accounts, roles, configurations and the data placed into the service.

This shared model is the main reason cloud services are powerful and also easy to misuse. A service can be technically sound yet still become risky if an organisation assumes the provider manages every layer, or if it overlooks how internet exposure, administrative consoles and API access expand the attack surface.

Access Paths, Accounts and APIs

Most cloud services are controlled through web portals and APIs, so access is usually mediated by identities, tokens, keys and role assignments rather than by physical network location. That means the security of the service often depends less on the hosting model itself and more on how tightly access is defined and monitored.

For practitioners, the practical question is not whether the service is "in the cloud" but whether each access path is intentional and bounded. Overly broad roles, long-lived API keys and unmanaged service credentials can turn a convenience feature into a persistent control weakness.

Configuration, Isolation and Shared Tenancy

Cloud-based services often rely on configuration settings to define exposure, encryption, logging, retention and trust boundaries. In practice, many incidents arise not from the platform architecture itself but from insecure defaults, permissive sharing, weak tenant separation or overlooked integration settings.

Because these services are built for scale, the same misconfiguration can replicate across many resources very quickly. That is why cloud security work often focuses on configuration hygiene, environment separation and continuous review of the settings that govern data flow and administrative reach.

Resilience, Visibility and Dependency

Using a provider-hosted service creates a dependency on external availability, identity systems, APIs and change control. Outages, regional failures, throttling, account lockouts and provider-side incidents can all affect business operations even when internal systems remain healthy.

Visibility is also different from on-premises software. Logs may be distributed across provider tools, application telemetry and customer-owned monitoring, so organisations need enough observability to detect misuse, investigate failures and understand what happened after a compromise or service disruption.

Risk and Threat Considerations

Cloud-based services concentrate value, access and data in internet-reachable platforms, which makes them attractive to attackers and unforgiving of misconfiguration. A weak console password, exposed API key or overly permissive role can provide direct access to data, workloads or administrative controls.

Failure mechanism: Compromise usually starts with stolen credentials, abused tokens, misconfigured storage or exposed management interfaces, then moves into data access, privilege escalation, persistence or exfiltration through legitimate service functions.

Impact: The result can be unauthorized disclosure, service disruption, fraudulent actions, ransomware staging, account takeover or loss of trust in the provider relationship and the organisation's control environment.

Practitioner Guidance

Governance implication: Cloud services should be owned as part of the security architecture, not treated as a pure procurement decision. Define who is responsible for account administration, configuration review, logging, backup, key management and incident response before the service is widely adopted.

What to watch for: Pay close attention to services that expose broad admin consoles, long-lived API credentials, public sharing features or inconsistent logging. Those are the places where cloud convenience most often becomes cloud exposure.

Related resources from NHI Mgmt Group

• Why does key ownership matter more as organisations move to cloud-based encryption services?
• How should security teams stop browser-based services from reaching cloud metadata endpoints during automated scanning?
• Why do traditional domain-based environments create risk when organisations rely on remote work, cloud services, and heterogeneous devices?
• When does cloud-based IAM create more value than keeping identity services on premises?