5.1 Trust and Security in the Cloud
Key Takeaways
- Cloud security follows a shared responsibility model: the provider secures the infrastructure while the customer secures data, identity, access, and configuration
- The expanded security model rests on five pillars: control, compliance, confidentiality, integrity, and availability (the CIA triad plus control and compliance)
- Cloud shifts risk from perimeter defense to configuration management — misconfiguration is now the leading cause of cloud data breaches
- Core security terms — authentication, authorization, encryption, IAM, least privilege, zero trust, SecOps, vulnerability, threat, risk, mitigation — form the vocabulary every cloud leader must speak fluently
5.1 Trust and Security in the Cloud
Quick Answer: Cloud security is not a single product — it is a shared responsibility. The cloud provider secures the infrastructure (hardware, network, facilities), and you secure what you put on top of it (data, identities, access policies, configurations). The expanded security model adds control and compliance to the classic CIA triad of confidentiality, integrity, and availability.
Security is a business issue, not just a technical one. A single breach can trigger regulatory fines, lost customer trust, downtime, and executive turnover. This section grounds you in the threats, the model, and the vocabulary so you can make informed cloud security decisions.
Today's Top Cybersecurity Threats and Business Implications
Threats evolve, but a recognizable set dominates incident reports year after year. Understanding each threat's business implication — not just its technical mechanism — is what a digital leader needs.
| Threat | What It Is | Business Implication |
|---|---|---|
| Phishing | Fraudulent messages that trick users into revealing credentials or installing malware | Account takeover, fraudulent wire transfers, lost customer trust; the most common breach entry point |
| Malware and Ransomware | Malicious software that encrypts or destroys data and demands payment | Operational shutdown, ransom payments, permanent data loss, regulatory disclosure obligations |
| Insider Threats | Current or former employees, contractors, or partners who misuse legitimate access | Hard-to-detect data exfiltration, sabotage, and IP theft; bypasses perimeter controls |
| Denial-of-Service (DDoS) | A Distributed Denial-of-Service attack floods a service with traffic to make it unreachable | Revenue loss during outages, SLA penalties, reputational damage, remediation costs |
| Data Breaches | Unauthorized access to or exfiltration of sensitive data | Regulatory fines (GDPR, HIPAA, PCI DSS), legal exposure, customer churn, brand damage |
| Supply-Chain Attacks | Adversaries compromise a trusted vendor or update channel to reach downstream targets | Hard to detect, wide blast radius, erodes trust in the software ecosystem (e.g., SolarWinds) |
| Misconfiguration | Public storage buckets, over-permissive IAM roles, exposed management ports — an inside job by accident | The leading cause of cloud data breaches; entirely preventable with proper controls |
Ransomware deserves special attention: it has moved from nuisance to national-security concern, with double-extortion variants that both encrypt data and threaten to publish it publicly.
Cloud Security vs Traditional On-Premises Security
The shift from on-premises to cloud reframes who is responsible for what.
| Dimension | On-Premises Security | Cloud Security |
|---|---|---|
| Perimeter | You own and defend the network edge (firewalls, VPNs) | The provider's network is the perimeter; you defend identity and configuration |
| Hardware | You buy, rack, patch, and replace servers | The provider owns and maintains hardware |
| Staffing | You hire and train a 24/7 security operations team | The provider runs global SOC teams for the infrastructure layer |
| Patching | You patch OS, firmware, and middleware yourself | The provider patches managed services; you patch what you control (apps, guest OS on IaaS) |
| Scaling Defenses | Capacity planning is hard and expensive | Defenses scale elastically with demand (e.g., DDoS absorption) |
| Misconfiguration Risk | Lower — the blast radius is your network | Higher — one wrong IAM policy or public bucket can expose data globally |
| Responsibility Model | You own everything end to end | Shared responsibility — provider secures infra, you secure data, identity, access, and config |
The cloud centralizes patching and scales defenses automatically, but it also centralizes the consequences of a mistake. A misconfigured bucket in the cloud can be world-readable in seconds; an on-prem misconfiguration is usually contained to your network. This is why misconfiguration is now the dominant cloud breach cause and why strong IAM hygiene and configuration scanning are non-negotiable.
The Security Model Pillars: Control, Compliance, and the CIA Triad
Google and the broader security community expand the classic CIA triad with two governance pillars to form a complete cloud security model.
| Pillar | Definition | Example Control |
|---|---|---|
| Control | Governance over who can do what, with accountability and least privilege | IAM roles, separation of duties, approval workflows |
| Compliance | Adherence to laws, regulations, and contractual obligations | SOC 2 audits, GDPR data-subject requests, HIPAA safeguards |
| Confidentiality | Data is visible only to authorized parties — secrecy | Encryption at rest and in transit, access labels |
| Integrity | Data is not altered or destroyed unauthorizedly — trustworthiness | Hashing, write-once storage, versioning, audit logs |
| Availability | Authorized users can access data and services when needed — resilience | Multi-region replication, DDoS protection, SLAs |
The CIA triad (Confidentiality, Integrity, Availability) describes what you are protecting. Control describes how you govern access to it. Compliance describes the external rules you must satisfy. Together they answer: What are we protecting? Who decides? What rules bind us?
Key Security Terms and Concepts Glossary
A shared vocabulary lets security, engineering, and leadership communicate without ambiguity.
| Term | Definition |
|---|---|
| Authentication (AuthN) | Verifying who a user or system is — identity proofing (passwords, 2SV, biometrics, certificates) |
| Authorization (AuthZ) | Determining what an authenticated identity is allowed to do — permissions and rights |
| Encryption | Transforming data into ciphertext using a key so only key-holders can read it; reversible with decryption |
| IAM (Identity and Access Management) | The discipline and tooling for managing digital identities and their permissions across systems |
| Least Privilege | Granting only the minimum access required to perform a task — no more, no less |
| Zero Trust | A model that assumes no implicit trust; every request is authenticated, authorized, and encrypted regardless of network location |
| SecOps (Security Operations) | The practice of continuously monitoring, detecting, investigating, and responding to security events |
| Vulnerability | A weakness in a system that could be exploited — the unlocked window |
| Threat | A potential actor or event that could exploit a vulnerability — the burglar |
| Risk | The probability and impact of a threat exploiting a vulnerability — the chance and cost of a break-in |
| Mitigation | An action that reduces risk — locking the window, adding an alarm, transferring risk via insurance |
Remember the chain: a vulnerability is a flaw, a threat exploits it, risk measures the danger, and a mitigation lowers the risk. Security work is fundamentally about shrinking that chain, layer by layer.
A company stores customer PII in a public cloud bucket that anyone on the internet can open. Which threat category does this represent?
Under the shared responsibility model, which of the following is the customer's responsibility in the cloud?
Which pillar of the expanded security model ensures data has not been altered or destroyed by unauthorized parties?