The cloud provider does not secure all your data

Imagine a company closing its on-site server room. The humming fans stop. The locked doors are opened for the last time. All the files and applications move to a provider like Amazon or Microsoft. This is a migration to the cloud, which means renting computing power and storage over the internet rather than owning the hardware.

For years, security was a matter of physical control. A technician put servers in a locked room with a badge reader. If an organisation moved its data to a distant data centre, it seemed logical that the provider would take over all the risk. The idea is simple: if the provider owns the building and the hardware, they must be responsible for keeping everything safe. It is an appealing thought. A manager can tick a box on a report and assume the problem has vanished into a professional facility.

The split of duties#

This belief persists because it sounds reasonable. However, it ignores a fundamental boundary established by the major cloud providers. This boundary is known as the shared responsibility model. It is a framework that defines exactly where the provider’s job ends and the customer’s job begins.

The provider secures the platform. They ensure the physical servers are locked away, the electricity stays on, and the software that runs the virtual machines is patched. This is security of the cloud. The customer remains responsible for everything they put inside that environment. This is security in the cloud. There is a certain peace of mind that comes from a signed contract, right up until the moment a database appears on a public forum because a setting was left on default.

Where things break#

When a business assumes the provider handles everything, gaps open in the defence. Most cloud breaches happen here. The most common failure is configuration. A cloud storage bucket is essentially a virtual folder for data. If the settings are not configured correctly, that folder becomes public to anyone with a web browser. The provider provides the lock, but the customer is the one who forgets to turn the key.

Identity and Access Management, or IAM, is another frequent point of failure. IAM is the system used to define who can access specific data and what they are allowed to do with it. When an organisation ignores its responsibility, it often grants too many permissions to too many people. A junior employee might accidentally have the power to delete an entire database. This is not a failure of the cloud platform; it is a failure of how the platform was used.

The provider ensures that the door to the data centre is locked. The customer is responsible for ensuring they do not leave the digital front door wide open and a welcome mat on the porch.

A different approach#

To avoid these traps, an organisation must shift its focus. Instead of looking at the provider as a total security solution, it should view the provider as a secure foundation. The first task is to find and read the shared responsibility document for every service in use. These documents are not optional reading; they are the map of who is liable when something goes wrong.

Once the boundaries are clear, the focus must turn to identity and configuration. This means auditing IAM roles to ensure people have only the minimum access required to do their jobs. It also means using automated tools to scan for open storage buckets or unencrypted disks. The goal is to stop treating the cloud as a magic box that handles security automatically and start treating it as a powerful tool that requires precise tuning.

Read the shared responsibility model for your specific cloud service today. Review every identity and access role in your environment. Change any setting that allows public access to private data.