Foundations of Cloud Computing and Cloud Security

Introduction

Cloud computing has changed information technology from a model based primarily on owned infrastructure to one based on on-demand access to shared, programmable computing resources. Organizations can obtain storage, networks, databases, applications, and analytical services through a provider’s platform, often paying according to consumption. This flexibility supports rapid innovation, global availability, and operational efficiency, but it also changes how security must be designed and managed.

Cloud security is not simply traditional information security relocated to a provider’s data centre. Cloud environments introduce elastic resources, software-defined infrastructure, extensive automation, provider dependencies, shared administrative control, and externally exposed management interfaces. Security therefore depends on understanding both technical mechanisms and the allocation of responsibility among the cloud provider, customer, users, developers, and third-party suppliers.

This chapter establishes the conceptual foundation for later study. It explains cloud characteristics, service and deployment models, shared responsibility, the confidentiality–integrity–availability (CIA) triad, trust boundaries, attack surfaces, threat actors, essential terminology, and the differences between traditional and cloud security.

Learning Objectives

After completing this chapter, students should be able to:

1. Explain the essential characteristics of cloud computing.
2. Distinguish infrastructure, platform, and software service models.
3. Compare public, private, hybrid, and community cloud deployments.
4. Analyze security responsibilities in different cloud arrangements.
5. Apply the CIA triad to cloud-security decisions.
6. Identify trust boundaries, attack surfaces, vulnerabilities, threats, and risks.
7. Describe major cloud threat actors and their motivations.
8. Compare traditional infrastructure security with cloud security.
9. Recommend foundational security controls for a cloud-based system.

1. The Meaning and Evolution of Cloud Computing

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with limited management effort. This widely used definition emphasizes a service model rather than a particular technology. Virtual machines, containers, serverless functions, and managed databases may all participate in cloud computing when they are delivered through such a model.

Earlier enterprise computing commonly involved purchasing servers, installing them in organizational facilities, and assigning administrators to maintain them. Capacity planning was performed in advance, and a system could remain underused except during peak demand. Cloud computing introduced a different operational model: resources can be requested through APIs or management consoles, scaled according to demand, and billed as an operational service.

Cloud computing is enabled by several technologies:

• Virtualization, which abstracts computing resources from physical hardware.
• Resource pooling, which allows provider infrastructure to serve multiple customers.
• Automation and orchestration, which provision and configure resources consistently.
• High-speed networks, which connect users, services, and distributed data centres.
• Application programming interfaces (APIs), which allow software to manage infrastructure.
• Measurement and billing systems, which record consumption and allocate cost.

Cloud computing is not identical to virtualization. Virtualization can exist in a private data centre without on-demand, measured, self-service delivery. Similarly, a hosted service may be externally operated without providing the elasticity or programmability associated with cloud computing.

2. Essential Characteristics of Cloud Computing

A cloud environment is commonly described through five characteristics.

2.1 On-demand self-service

A consumer can provision computing capabilities, such as storage or processing, automatically without requiring direct intervention from a provider employee. This supports speed and autonomy, but it also creates security risk: a user or compromised credential may create resources faster than a conventional approval process can detect them.

2.2 Broad network access

Cloud capabilities are available over networks through standard mechanisms and are accessible from diverse client platforms. Broad access supports remote work and mobile applications, but it increases the importance of identity management, endpoint security, secure protocols, and network-policy design.

2.3 Resource pooling

The provider’s physical and virtual resources serve multiple customers using a multi-tenant model. Customers normally do not know the exact physical location of their resources. Isolation mechanisms are therefore central to security. A failure in virtualization, storage isolation, identity policy, or provider configuration could expose one tenant to another.

2.4 Rapid elasticity

Resources can be rapidly expanded or reduced, sometimes appearing unlimited from the customer’s perspective. Elasticity supports resilience and variable workloads, but it complicates monitoring, asset inventories, incident investigation, and cost control. A short-lived resource can still process sensitive information or contain exploitable credentials.

2.5 Measured service

Cloud use is monitored, controlled, and reported according to defined measures such as storage consumption, requests, processing time, or network transfer. Measurement enables usage-based billing and supports governance. Unexpected consumption may indicate a legitimate workload increase, poor design, or abuse such as resource hijacking.

3. Cloud Service Models

Service models describe how much of the technology stack is operated by the provider and how much remains under customer control. The boundaries are not perfectly uniform across providers, so contracts and technical documentation must be examined carefully.

3.1 Infrastructure as a Service

In Infrastructure as a Service (IaaS), the provider supplies fundamental computing resources such as virtual machines, networks, and storage. The customer usually manages the operating system, installed applications, data, and many security configurations. The provider manages the physical facilities, hardware, and virtualization layer.

IaaS offers considerable flexibility and is suitable for migrating existing applications or building customized environments. Its flexibility also leaves customers responsible for patching guest operating systems, restricting network access, protecting credentials, and configuring storage correctly.

3.2 Platform as a Service

In Platform as a Service (PaaS), the provider manages the infrastructure and much of the operating-system and runtime environment. The customer concentrates on application code, data, and application configuration. Examples include managed application runtimes, databases, and development platforms.

PaaS can reduce maintenance effort and encourage secure standardization. However, insecure application code, excessive permissions, exposed secrets, and unsafe data handling remain customer responsibilities. A managed database is not automatically a secure database; access policies, encryption choices, logging, and data classification still matter.

3.3 Software as a Service

In Software as a Service (SaaS), the provider delivers a complete application to users through a network. The provider usually manages the infrastructure, application platform, and software. The customer remains responsible for account administration, data governance, user behavior, configuration, and appropriate use.

SaaS security commonly depends on identity federation, multi-factor authentication, role design, audit logs, data-retention settings, and integration controls. Customers may have less visibility into underlying systems than they would in IaaS.

3.4 Serverless and function-based services

Serverless computing is an operational style in which the provider manages server provisioning and scaling while customers submit functions or other units of code. Serverless does not mean that servers do not exist; it means that customers do not normally administer them. Security attention shifts toward code, dependencies, event sources, permissions, secrets, logging, and data flows.

Service-model comparison

4. Cloud Deployment Models

Public cloud

A public cloud is operated for general customers by a cloud service provider. It offers broad scalability and a large range of services. Customers share provider infrastructure logically, while isolation mechanisms separate tenants. Public cloud security depends on both provider controls and accurate customer configuration.

Private cloud

A private cloud is dedicated to one organization. It may be operated by the organization or a third party and may exist on or off the organization’s premises. A private cloud can support specialized compliance or control requirements, but it does not automatically provide better security. Poorly managed private infrastructure can be less secure than a well-managed public service.

Hybrid cloud

A hybrid cloud combines distinct cloud or on-premises environments that remain separate but are connected to support portability or coordinated operations. Hybrid arrangements may keep sensitive records in a private environment while using public-cloud elasticity for application processing. They introduce integration, identity, network, monitoring, and data-transfer challenges.

Community cloud

A community cloud is designed for organizations with shared requirements, such as regulatory, security, or mission requirements. Its governance must clearly define membership, control, liability, data handling, and operational responsibilities.

5. Shared Responsibility for Security

The shared-responsibility model states that cloud security is divided between the provider and the customer. The provider is responsible for security of the cloud, including physical facilities, hardware, core networking, and the underlying service infrastructure. The customer is responsible for security in the cloud, including data, identities, configurations, workloads, and use of the service.

The precise boundary depends on the service model. In IaaS, the customer has a broad responsibility. In SaaS, the provider operates more of the stack, but the customer still controls users, data, access permissions, and configuration options.

A useful way to analyze responsibility is to ask four questions:

1. Who owns the asset or data?
2. Who can configure the relevant control?
3. Who monitors its operation?
4. What does the contract say about assurance, notification, and liability?

Shared responsibility does not mean that responsibility is automatically shared equally. It means that responsibility is allocated across parties and must be made explicit. Organizations should maintain a responsibility matrix covering identity, encryption, patching, vulnerability management, backup, incident response, logging, privacy, and regulatory reporting.

A customer may delegate operation to a provider, but delegation does not eliminate governance responsibility. For example, a provider may offer encryption, yet the customer must determine whether encryption is required, select appropriate key-management options, restrict key access, and verify that backups and replicas are included.

6. The CIA Triad in Cloud Security

The CIA triad provides a foundational model for security objectives.

Confidentiality

Confidentiality means preventing unauthorized disclosure of information. Cloud confidentiality controls include identity and access management, least privilege, encryption in transit and at rest, tenant isolation, secrets management, data-loss prevention, and careful logging. Confidentiality failures can result from public storage permissions, compromised accounts, exposed API keys, or inappropriate data sharing.

Integrity

Integrity means preserving the accuracy, completeness, and trustworthiness of data and systems. Controls include access restrictions, cryptographic hashes, digital signatures, versioning, immutable backups, change management, and audit trails. Integrity is especially important for financial records, software images, configuration files, and security logs.

Availability

Availability means that authorized users can access systems and data when required. Cloud availability controls include redundancy, multiple availability zones or regions, automated recovery, capacity planning, denial-of-service protection, backup restoration, and tested business-continuity plans. High availability does not mean that service is invulnerable; it means that design reduces the likelihood and impact of interruption.

Security decisions involve trade-offs. Stronger confidentiality controls may introduce access friction. Replication may improve availability but increase the number of locations requiring protection and may create data-residency issues. A sound design begins with business impact, legal obligations, and information classification rather than applying controls mechanically.

7. Trust Boundaries and Attack Surfaces

A trust boundary is a logical or administrative boundary across which data, commands, or identities move between parties or components that are not equally trusted. Examples include the boundary between a user and a SaaS application, between a customer account and a provider control plane, between a public network and a private subnet, and between application code and a managed database.

Trust is not binary. A component may be trusted to perform one function but not another. A cloud provider may be trusted to operate physical infrastructure, while the customer still requires independent evidence concerning access to sensitive data. Security design should identify assumptions at each boundary and reduce unnecessary trust.

An attack surface is the collection of points through which an attacker may attempt to enter, influence, misuse, or extract information from a system. Cloud attack surfaces include:

• Internet-facing applications and APIs.
• Management consoles and administrative APIs.
• Identity providers, credentials, tokens, and federation links.
• Storage buckets, databases, queues, and backup locations.
• Virtual machines, containers, images, and dependencies.
• Network connections between cloud and on-premises systems.
• CI/CD pipelines and infrastructure-as-code repositories.
• Third-party integrations and marketplace components.
• Support channels and privileged provider operations.

Elasticity makes attack-surface management dynamic. An accurate asset inventory must account for resources that are created and destroyed automatically. Controls should therefore be expressed as policies and automated checks, not only as manual reviews.

8. Security Terminology and Risk Concepts

A threat is a potential cause of harm. A threat actor is an individual, group, organization, or automated process capable of carrying out a threat. A vulnerability is a weakness that can be exploited. An exploit is a technique, code, or action that takes advantage of a vulnerability. An incident is an event that has compromised, or threatens to compromise, confidentiality, integrity, or availability. A control is a safeguard that reduces risk.

Risk describes the possibility that a threat will exploit a vulnerability and produce an adverse consequence. In introductory risk analysis, risk is often represented qualitatively as a combination of likelihood and impact. This is a conceptual model rather than a universal numerical law; organizations should define their own scales and assumptions.

A misconfiguration is an insecure or inappropriate setting, such as unrestricted administrative access or publicly readable storage. Misconfiguration is particularly important in cloud environments because services are numerous, programmable, and frequently changed.

Authentication establishes or verifies identity. Authorization determines what an authenticated identity may do. Accounting, or auditing, records actions for investigation and accountability. Confusing authentication with authorization is a common design error: proving who a user is does not establish that the user should access a particular resource.

Least privilege grants only the permissions necessary for an authorized task. Defense in depth uses multiple independent or partially independent controls so that failure of one control does not cause total compromise. Zero trust is an architectural approach that avoids implicit trust based solely on network location and continuously evaluates identity, device, request context, and policy.

9. Threat Actors in Cloud Environments

Cloud threats come from both external and internal sources.

• Cybercriminals seek financial gain through credential theft, fraud, extortion, or resource hijacking.
• Nation-state groups may pursue espionage, disruption, political objectives, or strategic advantage.
• Insiders may be malicious, coerced, negligent, or simply careless.
• Hacktivists may attack systems to promote political or social causes.
• Competitors may seek information or disruption, although evidence and legal procedures are essential before attributing activity.
• Supply-chain attackers compromise software, dependencies, build systems, managed services, or trusted integrations.
• Automated opportunistic attackers continuously scan exposed systems and exploit common weaknesses.

Threat modeling should consider capability, motivation, access, persistence, and likely targets. A low-skilled automated attacker may exploit an exposed storage service, while a sophisticated actor may compromise an identity provider or software pipeline.

10. Traditional Security Compared with Cloud Security

Traditional security often assumes relatively stable hardware, a defined organizational perimeter, and direct administrative control over infrastructure. Cloud security operates in a more distributed and programmable environment.

The comparison does not mean that perimeter controls are obsolete. Firewalls, segmentation, patching, and endpoint protection remain useful. However, they must be combined with identity-centric access, API security, workload protection, continuous configuration assessment, and provider governance.

Cloud also changes the meaning of administrative privilege. A single compromised identity may create resources, modify network rules, access data, disable logging, and exfiltrate secrets through APIs. Privileged access management, phishing-resistant authentication, separation of duties, short-lived credentials, and monitoring of administrative actions are therefore foundational.

11. Foundational Cloud-Security Practices

A practical security programme should begin with governance and architecture rather than isolated tools.

Establish governance and classification

Identify data owners, classify information, define retention requirements, document regulatory obligations, and approve acceptable cloud services. Contracts should address data location, subcontractors, incident notification, service availability, evidence, deletion, and termination support.

Secure identities

Use centralized identity where appropriate, multi-factor authentication, role-based access, least privilege, privileged-access management, conditional access, and periodic entitlement reviews. Avoid long-lived access keys; where possible, use short-lived, workload-specific credentials.

Apply secure configuration

Use approved baseline configurations, infrastructure as code, policy-as-code, automated scanning, and continuous drift detection. Disable public access by default and require explicit justification for exceptions.

Protect data

Encrypt sensitive data in transit and at rest, manage keys separately from data where appropriate, protect secrets in dedicated systems, control backup access, and verify deletion and retention behavior.

Monitor and respond

Collect relevant identity, API, workload, network, and data-access logs. Protect logs from unauthorized alteration, synchronize time sources, define alert priorities, and rehearse response procedures with the provider. Monitoring should support both detection and forensic investigation.

Design for resilience

Use redundancy appropriate to business requirements, test backups through restoration exercises, document dependencies, and assess provider or region failure. A backup that has never been restored is an assumption rather than demonstrated resilience.

12. Illustrative Case: Public Storage and Excessive Privilege

Background

A fictional online retailer, Northstar Outfitters, moves its product-image service and customer-order application to a public cloud. Developers create object storage for images, a managed database for orders, and automated deployment pipelines.

Problem

A security review discovers that one storage location permits public listing, a deployment account has administrator-level permissions, and database backups are retained without documented classification. No incident has yet been confirmed, but the configuration creates significant confidentiality and integrity risks.

Analysis

The public listing expands the attack surface and could disclose product information or hidden files. The administrator-level deployment account violates least privilege and creates a high-impact identity boundary failure. Unclassified backups may contain personal and transactional information, creating privacy, retention, and breach-notification concerns. The provider supplies the storage and database service, but Northstar remains responsible for access policies, data classification, identity permissions, and retention settings.

Approach and solution

Northstar disables public access by default and permits image retrieval through an authenticated application or controlled content-delivery mechanism. It replaces the administrator account with separate deployment roles that can update only approved services. Multi-factor authentication is required for human administrators, while automated workloads use short-lived credentials. Backups are classified, encrypted, access-controlled, and assigned a documented retention period. Centralized logs record policy changes, administrative actions, and data access. The organization then performs a restoration test and adds automated configuration checks to the deployment pipeline.

Outcome

The retailer reduces unnecessary exposure, limits the potential impact of credential compromise, and improves evidence for auditing and incident response. The case demonstrates that cloud security is primarily a combination of architecture, identity, configuration, automation, and governance—not merely a provider purchasing decision.

Learning points

1. Provider infrastructure security does not correct customer misconfiguration.
2. Identity permissions can be more consequential than network location.
3. Backups and temporary resources are part of the security boundary.
4. Automated preventive controls are more reliable than occasional manual inspection.
5. Security requirements must be linked to data value and business impact.

13. Challenges, Ethics, and Contemporary Developments

Cloud customers face concentration risk because many services depend on a small number of large providers. A provider outage, policy change, pricing change, or compromise can affect many customers simultaneously. Organizations should assess portability, dependency, exit plans, and the feasibility of multi-provider or hybrid strategies without assuming that duplication automatically improves security.

Privacy and sovereignty issues arise when data is replicated across jurisdictions or processed by subcontractors. Ethical security practice requires proportional collection, transparent use, protection of individuals, and responsible disclosure of vulnerabilities. Compliance is necessary but not sufficient: a formally compliant design can still expose users through poor access control or unsafe defaults.

Artificial intelligence is increasingly used for anomaly detection, code analysis, incident triage, and security operations. It can improve scale, but its outputs require validation. Cloud environments may also host AI workloads containing sensitive prompts, training data, models, and intellectual property. Security controls must therefore address model access, data leakage, supply-chain integrity, and unauthorized inference. AI should support—not replace—human accountability and risk judgment.

Contemporary cloud security is increasingly organized around identity-centric and zero-trust principles, secure software supply chains, continuous control monitoring, confidential-computing techniques, cloud-native application protection, and security automation. These developments do not eliminate fundamental principles. They make accurate inventories, clear responsibility, least privilege, resilient design, and trustworthy evidence even more important.

Chapter Summary

Cloud computing delivers shared, network-accessible resources through on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Its major service models are IaaS, PaaS, and SaaS; its major deployment models include public, private, hybrid, and community cloud.

Cloud security follows a shared-responsibility model. Providers protect the underlying cloud infrastructure, while customers protect data, identities, workloads, and configurations according to the service arrangement. The CIA triad frames security objectives as confidentiality, integrity, and availability. Trust boundaries identify changes in control or trust, while attack surfaces identify points that attackers may exploit.

Threats may come from criminals, insiders, nation-state actors, supply-chain attackers, and automated scanners. Important controls include strong identity management, least privilege, multi-factor authentication, secure configuration, encryption, logging, vulnerability management, resilience testing, governance, and incident response. Compared with traditional environments, cloud security is more dynamic, API-driven, identity-centric, and dependent on provider relationships and automation.

Key Terms

Cloud computing: On-demand network access to a shared pool of configurable computing resources.

IaaS: A service model providing virtualized computing, storage, and networking resources.

PaaS: A service model in which the provider manages infrastructure and runtime platforms for customer applications.

SaaS: A complete software application delivered and operated as a service.

Public cloud: Cloud infrastructure offered by a provider to multiple customers.

Private cloud: Cloud infrastructure dedicated to one organization.

Hybrid cloud: Connected but distinct cloud or on-premises environments.

Shared responsibility: Allocation of security duties between provider and customer.

Confidentiality: Protection against unauthorized disclosure.

Integrity: Protection of accuracy, completeness, and trustworthiness.

Availability: Accessibility of systems and information when authorized users require them.

Trust boundary: A boundary across which data, commands, or identities move between differently trusted components or parties.

Attack surface: The set of points that may be used to attack or influence a system.

Threat: A potential cause of harm.

Vulnerability: A weakness that may be exploited.

Risk: The possibility of adverse consequences arising from threats and vulnerabilities.

Least privilege: Granting only the access necessary for an authorized task.

Defense in depth: Use of multiple protective controls so one failure does not cause total compromise.

Zero trust: An approach that avoids implicit trust and continuously evaluates access requests.

Misconfiguration: An insecure or unsuitable system or service setting.

Review Questions

Short Answer Questions

1. What are the five essential characteristics of cloud computing?
2. How does PaaS differ from IaaS in the allocation of management responsibility?
3. Define confidentiality, integrity, and availability.
4. What is a trust boundary? Give one cloud example.
5. Why is multi-factor authentication important in cloud environments?

Long Answer Questions

1. Compare IaaS, PaaS, and SaaS, including customer responsibilities and typical security concerns.
2. Explain the shared-responsibility model and discuss why it varies by service model.
3. Compare traditional perimeter-oriented security with identity-centric cloud security.
4. Explain how elasticity and automation affect cloud asset management and incident response.
5. Discuss how governance, privacy, resilience, and provider dependency influence cloud-security decisions.

Analytical / Application Questions

1. A company stores sensitive customer records in a managed database and allows developers to deploy application code. Identify the likely provider and customer responsibilities, and recommend five controls.
2. An employee’s cloud administrator account is compromised. Analyze which trust boundaries and attack surfaces may be affected, and propose an incident-response sequence.
3. A public-cloud workload requires high availability across regions but is subject to data-residency restrictions. Evaluate the availability, confidentiality, integrity, legal, and operational trade-offs of a multi-region design.

Multiple Choice Questions with Answers

Question 1

Which characteristic allows a cloud consumer to provision resources without direct provider-employee intervention?

A. Measured service

B. On-demand self-service

C. Resource pooling

D. Broad network access

Correct Answer: B. On-demand self-service

Question 2

In a typical IaaS arrangement, which responsibility usually remains with the customer?

A. Maintaining the provider’s physical data centre

B. Replacing failed physical storage hardware

C. Patching the guest operating system

D. Securing the provider’s virtualization layer

Correct Answer: C. Patching the guest operating system

Question 3

Which cloud deployment model combines distinct cloud or on-premises environments through connectivity and coordinated operation?

A. Public cloud

B. Private cloud

C. Community cloud

D. Hybrid cloud

Correct Answer: D. Hybrid cloud

Question 4

Which CIA objective concerns preventing unauthorized disclosure of information?

A. Confidentiality

B. Integrity

C. Availability

D. Accountability

Correct Answer: A. Confidentiality

Question 5

Which statement best describes a trust boundary?

A. A list of all software licenses in an organization

B. A boundary across which data or identities move between differently trusted components

C. A provider’s billing threshold for a service

D. A physical wall around a data centre

Correct Answer: B. A boundary across which data or identities move between differently trusted components

Question 6

Which situation is the clearest example of a cloud misconfiguration?

A. A storage resource is unintentionally accessible to the public

B. A provider replaces a failed disk

C. A user signs in with multi-factor authentication

D. A workload scales during expected demand

Correct Answer: A. A storage resource is unintentionally accessible to the public

Question 7

What is the principal purpose of least privilege?

A. To give every user administrative access temporarily

B. To eliminate the need for authentication

C. To grant only the permissions required for an authorized task

D. To ensure that all services run in one network segment

Correct Answer: C. To grant only the permissions required for an authorized task

Question 8

In a typical SaaS arrangement, which activity remains primarily a customer responsibility?

A. Managing the provider’s physical servers

B. Replacing the application’s underlying hardware

C. Operating the provider’s virtualization platform

D. Managing user access and appropriate data sharing

Correct Answer: D. Managing user access and appropriate data sharing

Question 9

Why can cloud elasticity complicate security monitoring?

A. Resources may be created and destroyed dynamically

B. Elasticity prevents the use of encryption

C. Elasticity removes all provider responsibilities

D. Resources can never be logged

Correct Answer: A. Resources may be created and destroyed dynamically

Question 10

Which control most directly reduces the impact of a compromised high-privilege cloud account?

A. Increasing storage capacity

B. Using least privilege and privileged-access management

C. Disabling all backups

D. Allowing anonymous access to applications

Correct Answer: B. Using least privilege and privileged-access management