Glossary
Cloud storage security
Cloud storage security is the set of controls that prevents unauthorized reading, changing or deleting of data held in cloud and object storage. It combines access policy, encryption, retention locks and logging. Most incidents it has to withstand begin with a valid identity, such as a leaked access key, rather than a software exploit.
Four layers of control
| Layer | What it does | What it does not stop |
|---|---|---|
| Access policy | Decides which identities can perform which actions on which buckets, starting from default deny | Actions by an allowed identity, including a stolen one |
| Encryption | Makes copied data unreadable without the keys, in transit and at rest; key handling is covered under backup encryption | A valid identity reading data, which is decrypted on request |
| Retention locks | Block deletion and overwrite until a set date, whoever asks, as with object locking | Reading or copying the data |
| Logging | Records every action for detection and investigation | Nothing by itself; it shows what happened |
Each layer covers a gap the others leave. Encryption at rest protects against a lost drive, not against a logged-in attacker, so access policy and key control decide most of the exposure.
Who secures which layer?
In a public cloud the provider secures facilities, hardware and the storage service itself. The customer owns identities, permissions, configuration and the data. A publicly readable bucket or a leaked access key is therefore the customer's incident, however well the platform is run. In a private cloud or on owned infrastructure, the organization takes on the physical and platform layers as well.
When one account controls everything
A common design places the data, the logging configuration and the retention settings under one administrative identity. A stolen key for that identity then does three jobs in sequence: it turns logging off, deletes the data and its backups, and removes the trail. How such keys are obtained is covered under credential theft.
The countermeasure is separation. Logs go to a system the storage administrator cannot edit. Retention uses a mode that no one, administrators included, can shorten before the date expires. Destructive actions can require a second approval or a separate role. Identity checks follow zero trust security, in which each request is verified and no network location is trusted by default. A control that the attacking account can switch off provides detection at most.
Configuration drift
Many cloud storage exposures come from settings rather than from flaws in the service: a bucket opened for a test and never closed, a policy broadened to fix an urgent access problem, an access key embedded in a script. Continuous checks against a defined baseline, with alerts on changes to bucket policies and lock settings, catch these before an outside party does. Data held under locks that cannot be shortened stays restorable even when one of these mistakes is exploited, which is the property an immutable backup relies on.