* [Topics](/en/topics "Topics")
* [Security](/en/topics/security "Security")
* What is different about cloud security
What is different about cloud security
======================================
Published  March 19, 2018•*5*-minute read
Copy URL
Jump to section
---------------
OverviewWhy is it differentCloud security is a shared responsibilityAre public clouds secure?DevSecOps for cloud-native securityMitigate risk with hybrid cloud
Overview
--------
Cloud security is the protection of data, applications, and infrastructures involved in [cloud services](/en/topics/cloud-computing/what-are-cloud-services) and [cloud computing](/en/topics/cloud-computing). Many aspects of security for cloud environments (whether it’s a [public](/en/topics/cloud-computing/what-is-public-cloud), [private](/en/topics/cloud-computing/what-is-private-cloud), or [hybrid](/en/topics/cloud-computing/what-is-hybrid-cloud) cloud) are the same as for any on-premise IT architecture.
Why cloud security is different
-------------------------------
High-level [information technology (IT) security](/en/topics/security), or cybersecurity, concerns—like unauthorized data exposure and leaks, weak access controls, susceptibility to attacks, and availability disruptions—affect traditional IT and cloud systems alike. Like any computing environment, cloud security involves maintaining adequate preventative protections so you:
* Know that the data and systems are safe.
* Can see the current state of security.
* Know immediately if anything unusual happens.
* Can trace and respond to unexpected events.
While many people understand the benefits of cloud computing environments, they’re equally deterred by the potential for security issues. We get it. It’s hard to wrap your head around something that exists somewhere between amorphous resources sent through the internet and a physical server. It’s a dynamic environment where things are always changing—like security threats. The thing is that, for the most part, [cloud security is *IT security*](/en/blog/modern-it-security-sometimes-caring-not-sharing). And once you understand the specific differences, the word "cloud" doesn’t feel as insecure.
### Dissolving perimeters
![Icon of rectangle going from solid stroke to dashed](/rhdc/managed-files/styles/default_800/private/Icon_RH_Misc_rectangle-RGB_Flat-500x320.png.webp?itok=jiFLv56f "Icon showing security perimeters dissolving")
Security has a lot to do with access control. Traditional environments usually regulate access using a perimeter security model. Cloud environments are highly connected, making it easier for traffic to bypass traditional perimeter defenses. Insecure [application programming interfaces (APIs)](/en/topics/api/what-are-application-programming-interfaces), weak identity and credentials management, hackers, and malicious insiders may pose threats to the system and data security. Preventing vulnerabilities and unauthorized access in the cloud requires shifting to a data-centric approach. Encrypt the data. Strengthen the authorization process. Require strong passwords and 2 factor authentication. Build network security measures into every level.
### Everything is now in software
![Icon of datacenter wrapped in a dashed stroke representing virtualization ](/rhdc/managed-files/styles/default_800/private/Icon_RH_Hardware_Datacenter-A-Virtual_RGB-_Flat500x216.png.webp?itok=CIhLaLO3 "Icon of virtual datacenter")
"Cloud" refers to the hosted resources delivered to a user via software. Cloud computing infrastructures—along with all the data being processed—are dynamic, scalable, and portable. Cloud security controls need to respond to environmental variables and accompany workloads and data while at rest and in transit, either as inherent parts of the workloads (e.g. encryption) or dynamically through a [cloud management](/en/topics/cloud-computing/what-is-cloud-management) system and APIs. This helps to protect and secure cloud environments from system corruption and data breaches.
### Sophisticated threat landscape
![Icon with exclamation point inside triangle](/rhdc/managed-files/styles/default_800/private/Icon_RH_Signage_Alert_RGB_Flat-500x320.png.webp?itok=LptAgK2w "Warning icon")
Sophisticated threats are anything that negatively impacts modern computing which—of course—includes the cloud. Increasingly sophisticated [malware](/en/topics/security/what-is-malware) and other attacks like Advanced Persistent Threats (APTs) are designed to evade network defenses by targeting [vulnerabilities](/en/topics/security/what-is-cve) in the computing stack. Data breaches can result in unauthorized information disclosure and data loss or tampering. There’s no clear solution to these threats, except that it’s your responsibility to stay on top of the cloud security practices that are evolving to keep up with emerging threats.
Red Hat resources
-----------------
[Keep reading](/en/resources "Keep reading")
Cloud security is a shared responsibility
-----------------------------------------
Regardless of what cloud deployment you’re using, you’re responsible for securing your own space within that cloud. Using a cloud maintained by someone else doesn’t mean you can—or should—sit back and relax. Insufficient due diligence is a major cause of security failures. Cloud security is everyone’s responsibility, and that includes:
### Using trusted software
What’s inside your cloud matters. As with any code you download from an external source, you need to know where the packages originally came from, who built them, and if there’s malicious code inside them. Obtain software from known, trusted sources and ensure that mechanisms are in place to provide and install updates in a timely way.
### Understanding compliance
Personal, financial and other sensitive cloud data may be subject to strict compliance regulations. The laws vary depending on where (and with whom) you do business—for example, see the European Union’s [General Data Protection Regulation (GDPR)](//access.redhat.com/gdpr). Check your compliance requirements before choosing a cloud deployment.
### Managing lifecycles
Cloud-native environments make it easy to spin up new instances—and it’s also easy to forget about the old ones. Neglected instances can become cloud zombies—active but unmonitored. These abandoned instances can become outdated quickly, which means no new security patches. Lifecycle management and governance policies can help.
### Considering portability
Can you easily move your workloads to another cloud? Service-level agreements (SLA) should clearly define when and how the cloud provider returns the customer’s data or applications. Even if you don’t foresee moving things soon, it’s likely a future scenario. Prevent future lock-in concerns by considering portability now.
### Continuous monitoring
Monitoring what’s going on in your workspaces can help you avoid—or at least inhibit the effect of—security breaches.
### Choosing the right cloud provider
Hire and partner with qualified, trustworthy people who understand the complexities of cloud services and security. Sometimes, a public cloud’s infrastructure may be more secure than a particular organization’s private cloud, because the public cloud provider has a better informed and equipped security team.
Are public clouds secure?
-------------------------
Ok. Let’s talk about it. We could tell you all about the security differences between the 3 cloud deployments—[public, private, and hybrid](/en/topics/cloud-computing/public-cloud-vs-private-cloud-and-hybrid-cloud)—but we know what you’re really wondering: "Are public clouds secure?" Well, it depends.
Public clouds—for example, [Amazon Web Services (AWS)](/en/partners/aws), [Microsoft Azure](/en/partners/microsoft), and [Google](/en/partners/google)—are appropriately secure for many types of workloads, but aren’t right for everything, largely because they lack the isolation of private clouds. Public clouds support [multitenancy](/en/topics/cloud-computing/what-is-multitenancy), meaning you rent computing power (or [storage space](/en/topics/data-storage)) from the cloud service provider's data center alongside other "tenants". Each tenant signs a service-level agreement (SLA) with the [cloud provider](/en/topics/cloud-computing/what-are-cloud-providers) that documents who’s responsible and liable for what. *It’s a lot like leasing a physical space from a landlord.* The landlord (cloud provider) promises to maintain the building (cloud infrastructure), hold the keys (access), and generally stay out of the tenant’s way (privacy). In return, the tenant promises not to do anything (e.g. run unsecured apps) that would corrupt the integrity of the building or bother other tenants. But you can’t choose your neighbors, and it’s possible to end up with a neighbor who lets in something harmful. While the cloud provider’s infrastructure security team is watching for unusual events, stealthy or aggressive threats—like malicious [distributed denial-of-service (DDoS) attacks](//en.wikipedia.org/wiki/Denial-of-service_attack)—can still negatively affect other tenants.
Fortunately, there are some industry-accepted security standards, regulations, and control frameworks like the [Cloud Controls Matrix](//cloudsecurityalliance.org/download/cloud-controls-matrix-v3-0-1/) from the Cloud Security Alliance. You can also isolate yourself in a multi-tenant environment by deploying additional security tools (like encryption and DDoS mitigation techniques) that protect workloads from a compromised infrastructure. If that’s not enough, you can release [cloud access security brokers](//en.wikipedia.org/wiki/Cloud_access_security_broker) to monitor activity and enforce security policies for low-risk enterprise functions. Though all this may not be sufficient for industries that operate under strict privacy, security, and compliance regulations.
DevSecOps for cloud-native security
-----------------------------------
DevSecOps is the combination of [DevOps practices](/en/topics/devops) and security strategies as a means for organizations to increase IT security and reduce risk to their software environments. Cloud-native technologies such as Kubernetes, containers, microservices, and service meshes have become tremendously popular because they provide the building blocks necessary for organizations to build, deploy, and run cloud applications more dynamically, reliably, and at greater scale than was previously possible.
The changes introduced by cloud-native technologies require organizations to evolve their security toward a DevSecOps model. This means security and engineering teams must work together to develop strategies that successfully help their organizations build and run modern, scalable applications, with [*shift left*](/en/topics/devops/shift-left-vs-shift-right)practices that incorporate security earlier in the [software development life cycle](/en/topics/security/software-development-lifecycle-security) and workflows that implement security as code.
[Learn more about DevSecOps](/en/topics/devops/what-is-devsecops "article | what is DevSecOps?")
Mitigate risk with hybrid cloud
-------------------------------
![Multiple icons forming a circle around a business man icon](/rhdc/managed-files/styles/default_800/private/cloud-icons-circling-person_300x283.png.webp?itok=b6r1Hn3j "Multiple icons forming a circle around a business man icon")
Security decisions have much to do with risk tolerance and cost-benefit analysis. How could potential risks and benefits affect the overall health of your organization? What matters most? Not every workload demands the highest level of encryption and cybersecurity. *Think about it like this:* Locking your home keeps all your belongings relatively secure, but you might still lock your valuables in a safe. It’s good to have options.
That’s why more enterprises are turning to [hybrid clouds](/en/topics/cloud-computing/what-is-hybrid-cloud), which give you the best of all the clouds. A hybrid cloud is a combination of 2 or more interconnected cloud environments—public or private.
Hybrid clouds let you choose where to place workloads and data based on compliance, audit, policy, or security requirements—protecting particularly sensitive workloads on a private cloud, while operating less-sensitive workloads in the public cloud. There are some unique hybrid cloud security challenges (like data [migration](/en/topics/automation/what-is-it-migration), increased complexity, and a larger attack surface), but the presence of multiple environments can be one of the strongest defenses against security risks.
### Learn about Red Hat’s approach to security and compliance
This video can't play due to privacy settings
To change your settings, select the "Cookie Preferences" link in the footer and opt in to "Advertising Cookies or try disabling adblockers."
The official Red Hat blog
-------------------------
Get the latest information about our ecosystem of customers, partners, and communities.
[Keep reading](/en/blog "The official Red Hat blog")
Recommended for you
Securing Kubernetes Clusters with Red Hat Advanced Cluster Security
-------------------------------------------------------------------
Customers want to learn how Red Hat Advanced Cluster Security for Kubernetes (RHACS) can help them solve their security challenges. However, their security teams might lack experience with Kubernetes and OpenShift, and so they have challenges with implementation.
[View course](https://www.redhat.com/en/services/training/do430-securing-kubernetes-clusters-red-hat-advanced-cluster-security?percmp=RHCTG0250000455236)
Keep reading
------------
### What is confidential computing?
Confidential computing uses hardware-based computing to protect data when it’s not at rest or in transit—while you’re actually running it.
[Read the article](/en/topics/security/what-is-confidential-computing "What is confidential computing?")
### What are SPIFFE and SPIRE?
SPIFFE and SPIRE are a pair of open source projects for identity management in dynamic and varied computing environments. Together they solve many security problems.
[Read the article](/en/topics/security/spiffe-and-spire "article | what are spiffe and spire?")
### Red Hat Enterprise Linux security
Red Hat Enterprise Linux is a world’s leading open source Linux platform, enabling you to mitigate risk, enforce security configuration and policy, and streamline compliance strategy.
[Read the article](/en/technologies/linux-platforms/enterprise-linux/security "product article | Red Hat Enterprise Linux security")
Security resources
------------------
### Related content
* Blog post
  [Attestation vs. integrity in a zero-trust world](/en/blog/attestation-vs-integrity-zero-trust-world)
* Analyst material
  [A unified hybrid cloud helps CAE deliver new flight experiences faster](/en/resources/cio-case-study-analyst-material)
* Blog post
  [Looking ahead to 2026: Red Hat’s view across the hybrid cloud](/en/blog/looking-ahead-2026-red-hats-view-across-hybrid-cloud)
* Overview
  [Simplify cloud security with Red Hat and Microsoft](/en/resources/simplify-cloud-security-with-azure-overview)
### Related articles
* [What is confidential computing?](/en/topics/security/what-is-confidential-computing)
* [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire)
* [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security)
* [What is zero trust?](/en/topics/security/what-is-zero-trust)
* [What is AI security?](/en/topics/ai/what-is-ai-security)
* [What is cloud migration? And how can automation help?](/en/topics/automation/what-is-cloud-migration)
* [Why run Linux on AWS?](/en/topics/linux/linux-on-aws)
* [What is hybrid cloud?](/en/topics/cloud-computing/what-is-hybrid-cloud)
* [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux)
* [What is serverless?](/en/topics/cloud-native-apps/what-is-serverless)
* [What is access control?](/en/topics/security/what-is-access-control)
* [Why choose Red Hat Enterprise Linux on Azure?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-azure)
* [What's the difference between cloud and virtualization?](/en/topics/cloud-computing/cloud-vs-virtualization)
* [Why choose Red Hat Enterprise Linux on AWS?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-aws)
* [What is a CVE?](/en/topics/security/what-is-cve)
* [What is CloudOps?](/en/topics/automation/what-is-cloudops)
* [Linux on Azure](/en/topics/linux/linux-on-azure)
* [Linux for cloud computing](/en/topics/linux/linux-for-cloud-computing)
* [Why run Linux on Google Cloud?](/en/topics/linux/linux-on-google-cloud)
* [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control)
* [What is secrets management?](/en/topics/devops/what-is-secrets-management)
* [What is kubernetes security?](/en/topics/containers/kubernetes-security)
* [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right)
* [Why choose Red Hat Enterprise Linux on Google Cloud?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-google-cloud)
* [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security)
* [Why are financial services slow to adopt the cloud?](/en/topics/financial-services/why-financial-services-are-slow-to-adopt-cloud)
* [What is CI/CD security?](/en/topics/security/what-is-cicd-security)
* [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS)
* [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM)
* [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking)
* [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform)
* [What is edge security?](/en/topics/security/what-is-edge-security)
* [What is Cloud Foundry?](/en/topics/application-modernization/what-is-cloud-foundry)
* [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience)
* [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management)
* [What is backup and recovery?](/en/topics/security/backup-and-recovery)
* [What is the role of the cloud in embedded finance?](/en/topics/financial-services/the-role-of-cloud-in-embedded-finance)
* [What is container security?](/en/topics/security/container-security)
* [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack)
* [Cloud services for financial services](/en/topics/financial-services/cloud-services-for-financial-services)
* [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack)
* [What is DevSecOps?](/en/topics/devops/what-is-devsecops)
* [What is compliance management?](/en/topics/management/what-is-compliance-management)
* [What is telco cloud?](/en/topics/cloud-computing/what-is-telco-cloud)
* [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops)
* [What is cloud orchestration?](/en/topics/automation/what-is-cloud-orchestration)
* [What is security automation?](/en/topics/automation/what-is-security-automation)
* [What is cloud governance?](/en/topics/automation/what-is-cloud-governance)
* [What is public cloud?](/en/topics/cloud-computing/what-is-public-cloud)
* [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security)
* [Cloud vs. edge](/en/topics/cloud-computing/cloud-vs-edge)
* [Why build a Red Hat cloud?](/en/topics/cloud-computing/why-choose-red-hat-cloud)
* [What is multicloud?](/en/topics/cloud-computing/what-is-multicloud)
* [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security)
* [What is cloud architecture?](/en/topics/cloud-computing/what-is-cloud-architecture)
* [What is cloud automation?](/en/topics/automation/what-is-cloud-automation)
* [Types of cloud computing](/en/topics/cloud-computing/public-cloud-vs-private-cloud-and-hybrid-cloud)
* [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices)
* [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication)
* [How Red Hat OpenShift enables container security](/en/technologies/cloud-computing/openshift/security)
* [What is SOAR?](/en/topics/security/what-is-soar)
* [Security for IoT devices](/en/topics/security/security-for-iot-devices)
* [What's an insider threat?](/en/topics/security/what-are-insider-threats)
* [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam)
* [What is cloud-based digital banking?](/en/topics/cloud-computing/what-is-cloud-based-digital-banking)
* [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security)
* [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security)
* [Container and Kubernetes compliance considerations](/en/topics/containers/compliance)
* [Do banking APIs benefit from cloud technology?](/en/topics/api/banking-api)
* [What is payments infrastructure?](/en/topics/financial-services/what-is-payments-infrastructure)
* [What is multitenancy?](/en/topics/cloud-computing/what-is-multitenancy)
* [What is private cloud?](/en/topics/cloud-computing/what-is-private-cloud)
* [What is risk management?](/en/topics/management/what-is-risk-management)
* [What is SELinux?](/en/topics/linux/what-is-selinux)
* [What is IT infrastructure?](/en/topics/cloud-computing/what-is-it-infrastructure)
* [What is cloud infrastructure?](/en/topics/cloud-computing/what-is-cloud-infrastructure)
* [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security)
* [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services)
* [What is API security?](/en/topics/security/api-security)
* [What is malware?](/en/topics/security/what-is-malware)
* [What is cloud storage?](/en/topics/data-storage/what-is-cloud-storage)
* [What is cloud management?](/en/topics/cloud-computing/what-is-cloud-management)
[More about this topic](/en/topics/security "More about this topic")