Cloud Security Glossary: Definitions, Controls, and Best Practices

This cloud security glossary explains the terms, concepts, and controls you need to assess and secure cloud environments. It defines foundational topics such as shared responsibility, identity and access management, encryption, logging, and compliance, with an emphasis on evergreen principles that remain relevant across providers and use cases. These explanations help security teams, architects, and operators evaluate cloud service offerings and implement practical protections.

Cloud security spans people, processes, and technology. Understanding standard terminology supports better decisions around architecture, monitoring, and incident response. The following entries clarify common terminology used by cloud providers, security frameworks, and auditors, with an emphasis on practical application.

Cloud Security Shared Responsibility Model

The shared responsibility model describes how security obligations are divided between a cloud provider and the customer. Provider responsibilities typically include the security of the cloud infrastructure that runs all services. Customer responsibilities vary by service type and are influenced by factors such as deployment model, service layer, and configuration.

Provider Responsibility Examples

• Physical data center security, power, and environmental controls
• Hypervisor and host operating system integrity
• Network infrastructure that supports managed services
• Availability SLAs and baseline service health

Customer Responsibility Examples

• Operating system configuration and patch management
• Identity and access policies, including least privilege and MFA
• Encryption key lifecycle management, when using customer-managed keys
• Network segmentation, security groups, and route tables
• Application security testing, configuration, and runtime protection
• Retention, analysis, and protection of logs and alarms

Identity and Access Management

Identity and access management (IAM) governs who can access cloud resources and what they can do. IAM controls include authentication, authorization, and identity federation. Strong IAM practices reduce the risk of unauthorized access and limit the impact of compromised credentials.

Key IAM Terms

• Identity provider (IdP): System that issues identities and authentication tokens
• Security token service (STS): Issues temporary security credentials
• Role-based access control (RBAC): Assigns permissions to roles rather than individuals
• Policy-based access control: Uses rules to define permissions, often expressed in policy languages
• Multi-factor authentication (MFA): Requires multiple verification factors for access
• Just-in-time (JIT) access: Grants elevated privileges only when needed
• Identity federation: Links identities across systems to enable single sign-on

Encryption and Key Management

Encryption protects data confidentiality and integrity. In cloud environments, encryption spans data at rest, data in transit, and, increasingly, data in use. Key management determines who controls encryption keys and how they are rotated, stored, and recovered.

• Encryption at rest: Protects stored data using disk, database, or object-level encryption
• Encryption in transit: Secures data between clients, services, and across networks with TLS or equivalent
• Envelope encryption: Encrypts data with a data key, which is itself encrypted under a master key
• Customer-managed keys (CMK): Keys you control and manage, often stored in a cloud key manager or on-premises HSM
• Hardware security module (HSM): Dedicated hardware device that safeguards and manages cryptographic keys
• Bring your own key (BYOK): Import your own keys into a cloud provider's key manager
• Hardware-backed key storage: Keys bound to hardware, raising the bar for extraction

Logging, Monitoring, and Observability

Logging and monitoring provide visibility into configuration changes, access events, and suspicious activity. Effective observability combines logs, metrics, and traces to detect anomalies and support incident response.

• Centralized logging: Aggregating logs to a common platform for analysis and retention
• Cloud audit logs: Records of management plane and data plane API calls, often retained for compliance
• Metric-based alerting: Triggers notifications based on observed metrics such as error rates or resource use
• Security information and event management (SIEM): Tools that correlate, analyze, and visualize security data
• Threat detection: Automated analysis to identify indicators of compromise and suspicious behavior
• Baseline and anomaly detection: Establishing normal behavior to spot deviations

Network Security Controls

Network security controls manage how traffic enters, exits, and moves through cloud environments. Proper configurations limit exposure and reduce lateral movement risk.

• Security groups: Virtual firewalls at the instance or load balancer level
• Network ACLs: Stateless packet filters at the subnet level
• Web application firewall (WAF): Protects applications against common web exploits
• Private endpoints: Private network connections to PaaS services, avoiding public internet
• Transit gateway: Centralized network hub for connecting VPCs, on-premises networks, and branch offices
• Zero trust: Security model that assumes breach and verifies each access request

Compliance, Risk, and Governance

Compliance frameworks and risk management practices help organizations align with legal, regulatory, and business requirements. Cloud providers publish compliance reports and certifications that describe coverage and limitations.

• Compliance certifications: Independent attestations of security controls (e.g., ISO 27001, SOC 2, PCI DSS)
• Artifacts: Policy documents, audit reports, and architectural reviews provided by providers
• Risk assessment: Systematic evaluation of threats, vulnerabilities, and potential impacts
• Data classification: Categorizing data by sensitivity to apply appropriate controls
• Data retention and disposal: Policies and technical controls for how long data is kept and how it is destroyed
• Business continuity and disaster recovery: Plans and tests to maintain availability during disruptions

Cloud Security Best Practices

• Understand the shared responsibility model for each service you use
• Apply least privilege and use RBAC with scoped roles
• Enable MFA for privileged accounts and enforce conditional access
• Manage encryption keys with clear ownership, rotation, and backup procedures
• Centralize and protect logs; retain for an appropriate period
• Use infrastructure as code (IaC) and automated policy checks to prevent misconfigurations
• Regularly review permissions, access patterns, and security findings
• Test backups, recovery processes, and incident response plans

Common Cloud Service Types and Security Boundaries

Different service models shift some responsibilities, but the customer's security obligations remain significant. This comparison describes typical boundaries and examples.

Use these definitions and relationship explanations to build checklists, training materials, and architecture reviews that remain useful over time.