Effective cloud security means multiple technologies working together to protect data and applications in the cloud from the various entry vectors of cyberthreats. On the technology side, this often includes firewalls, identity and access management (IAM), segmentation, and encryption, though security needs can vary by the type of cloud deployment.

Rather than protecting a perimeter the way network security does, cloud security leverages the above methodologies to protect cloud resources and data on an individual basis. This means implementing more granular and specific security measures, such as cloud security posture management (CSPM), data protection, data security, and disaster recovery as well as a bevy of tools to meet compliance requirements.

What are the security risks of cloud computing?

The cloud helps you build, deploy, use, and maintain resources in a more flexible, scalable way. Because your organization isn’t responsible for the hardware associated with these resources, you can utilize as much of the cloud’s vast availability as you need without having to invest in additional appliances to handle the scale.

The bad news? Leveraging cloud computing moves your enterprise resources off of the network, which means using a perimeter-style defense to protect these resources is a waste of time.

When you move to the cloud, you cast aside the perimeter, forcing your organization to re-evaluate everything from how and where employees work to how best to identify security issues, mitigate vulnerabilities, block malware, and prevent data loss.

Cloud service types

Ever since the inception and eventual refinement of the cloud model, organizations have adopted SaaS offerings and cloud platform and infrastructure services in public clouds from providers such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud.

Some organizations, particularly those in heavily regulated sectors such as government and finance, adopt private cloud models to better protect their resources. All told, there are four subtypes of cloud infrastructure deployment as well as four main service models. Let's quickly look at each of these.

The four cloud deployment subtypes are:

• Private cloud: Dedicated infrastructure used by one organization but owned by a third party or the organization itself, which is responsible for all aspects of security management
• Public cloud: Infrastructure owned by a third-party provider and shared among multiple organizations, which also share security responsibilities with the provider per the shared responsibility model
• Hybrid cloud: A combination of private and public deployment where an organization uses each for its strengths, such as scalability (public cloud) or stricter controls (private cloud)
• Multicloud: Shared infrastructure, generally used by organizations that need access to the same applications and/or have the same segmentation and privacy requirements (e.g., PCI DSS)

The four cloud service models are:

• Software as a service (SaaS): Complete software solutions delivered from the cloud, which can be free or paid—Google Docs, for example
• Platform as a service (PaaS): Cloud-delivered tools developers can use to build, test, and deploy applications in a scalable environment
• Infrastructure as a service (IaaS): Virtualized infrastructure onto which an organization can install software, avoiding the need to manage their own infrastructure
• Functions as a service (FaaS): Often called serverless computing, FaaS is similar to PaaS, but suited to individual functions of apps, which can be spun up or down very quickly