Cloud Security Basics: Access, Backups, Logs, Responsibility
Cloud security rests on four foundations: access control, backups, logging and shared responsibility. Which parts are yours, and which the provider's?
rabbitclip teamPublished: 6 min read
Short answer
Cloud security is the practice of protecting your data and systems on a provider's infrastructure by doing four things together: limiting who can reach what, keeping a separate backup of your data, recording what happens, and knowing which part of security belongs to the provider and which to you. The provider protects the physical infrastructure; protecting accounts, permissions and settings is your job. Most data leaks in the cloud come not from sophisticated attacks but from a setting left open or a weak password.
Cloud security is therefore less about buying an expensive tool than about applying a few basic habits with discipline. Below we set out the questions an owner or manager should ask, without going into technical detail.
What does cloud security consist of?
Four headings are enough to think with. Access is who can get into which resource. Backup is being able to return when something is lost. Logging is being able to see afterwards what happened. Responsibility is knowing who holds each of the other three.
The four are linked. If access is weak, even the backup can be deleted; if there is no logging, it is never clear when or how a problem began. Neglecting one lowers the value of the others.
- Access: accounts, permissions and the method of verification.
- Backup: copies kept elsewhere, whose restoration has been tried.
- Logging: traces showing who did what and when.
- Responsibility: which layer belongs to the provider and which to you.
What does shared responsibility mean in the cloud?
The provider protects the physical security of the data centre, the hardware and the virtualisation layer. You protect your accounts, user permissions, software updates, network rules and the data itself. Providers such as AWS, Google Cloud and Azure each describe this line in their own documentation, and it is worth reading.
Where the line falls depends on the type of service you use. On a managed database the provider applies the updates; on a virtual server you built yourself, updating is yours. Writing down at the start what stays with you for each service prevents arguments later.
How is access protected?
The basis of access control is the principle of least privilege: everyone is given only as much permission as the job needs. An accounts clerk has no need to change server settings. When permissions are granted broadly, a single stolen password opens the whole system.
The second basis is two-step verification. When a password leaks or is guessed, the second step still protects the account. For administrator accounts it should be compulsory. Shared passwords should also be dropped, because nobody can tell who did what, and when an employee leaves, changing the password affects everyone.
The third basis is a regular review of access. The account of someone who has left, a temporary account nobody uses, or an old service connection all remain a risk while they stay open. For a spa group, closing seasonal staff accounts when the season ends is a simple but effective routine.
- Give everyone only the permission they need.
- Make two-step verification compulsory on administrator accounts.
- Use personal accounts instead of shared passwords.
- Close departed and unused accounts on a regular basis.
Why should backups and logs be thought of separately?
A backup lets you return when something is deleted or damaged. A reliable backup is kept apart from where the original data lives, and its restoration has actually been tried; an untried backup is an assumption that it will work. A copying feature offered by the provider does not replace a separate backup strategy.
Logs let you understand what happened when there is trouble. Traces such as who signed in and when, or which setting was changed, make it possible to find the source of a problem. In a system that keeps no logs, even a solved problem leaves its cause unknown and the same fault returns. You may have a legal duty about how long logs are kept; for that you need to consult a lawyer.
When is every security layer unnecessary?
Security should be in proportion to risk. For a small brochure site holding no sensitive customer data, complicated network segmentation or costly monitoring tools are often unnecessary; basic access control, backups and updates are enough. More layers than you need produce complexity that nobody can manage.
On the other hand, in a system holding payment details, health data or personal data, these basics are not enough; further measures and legal requirements come into play. To see which side you are on, it is enough to ask what kind of data the system holds and what would happen if it leaked.
What mistakes are common in cloud security?
The commonest mistake is to assume the provider protects everything. A storage area left open to the public by accident is the best-known result of that assumption. The second mistake is to keep a backup in one place only and never try it.
The third mistake is to grant permissions broadly for convenience. It saves time at the start, but the price is high when an account is taken over. The fourth is to treat security as a one-off job; as settings, staff and services change, security has to be looked at again.
- Assuming the provider protects everything.
- Leaving storage areas open to the public by accident.
- Keeping the backup in one place and never trying it.
- Granting broad permissions for convenience.
- Treating security as a one-off job.
Cloud security rests on four foundations: limiting access, keeping a separate and tested backup, recording what happens, and knowing which part of responsibility is yours. None of this needs an expensive tool; it needs discipline. If you would like to review how far your present arrangement meets these foundations, you are welcome to arrange a discovery conversation with rabbitclip.
FAQ
Is the cloud more secure than my own server?
For physical security and hardware maintenance, often yes. But accounts, permissions and settings stay with you, so if you neglect them the cloud will not be more secure.
Does the provider not take backups?
Providers offer copying features, but these do not replace a separate backup strategy. You should check for yourself where the backup is kept and that restoring from it has been tried.
Is two-step verification really necessary?
For administrator accounts, yes. Even if a password leaks or is guessed, the second step protects the account and closes the most common route of attack.
Is it appropriate to use the cloud for personal data?
It can be, but data protection law places duties on you. You should consult a lawyer about where the data will be stored and how it will be protected.
