Home / Knowledge hub / Public cloud
Knowledge hub
Public cloud
Computing rented from a provider that shares its hardware across many customers.
What it means
Public cloud means renting computing, storage and networking from a provider such as AWS, Microsoft Azure or Google Cloud, rather than owning the machines. NIST defines it as infrastructure provisioned for open use by the general public, owned and run by an organisation that sells cloud services.
Many customers share the same physical hardware, kept apart by software. You pay for what you use, you can add capacity in minutes, and the provider looks after the buildings, power and physical machines.
Why it matters
Moving to public cloud does not move your security duties. The provider secures the underlying platform, and you secure what you put on it: settings, identities, data, and your application. This split is the shared responsibility model, and misunderstanding it is a common cause of exposure.
Cloud also makes mistakes fast. A single wrong setting can put a database on the internet, and because everything is created through software, the mistake can be copied to many places.
How it shows up
You meet it as accounts, regions, networks, servers, containers, functions and managed databases. The recurring problems are public storage, over-broad permissions, open ports, keys committed to code, and logging that was never turned on. See cloud misconfiguration.
Practical steps: secure the root account with multi-factor authentication, use separate accounts for production and test, give each workload a narrow role, turn on logging, and test the applications you run there. Public cloud is a platform, not a guarantee that the application on it is safe.
Questions people ask
Public cloud, answered
Is public cloud less secure than my own servers?
Not inherently. Providers run strong platforms, and many companies cannot match them. The risk lies in configuration and in the application, which remain your responsibility.
What is the difference between public, private and hybrid cloud?
Public cloud is shared and rented. Private cloud is dedicated to one organisation. Hybrid combines the two or links cloud with your own servers.
What does the provider secure for me?
The physical facilities, hardware and the base platform. Anything you configure or deploy, such as storage permissions, user access and application code, is yours.
Can other customers see my data?
They should not. Providers separate customers by software, and breaks in that separation are rare. Far more incidents come from a customer's own settings than from another customer.
Does an app on the cloud still need testing?
Yes. A cloud provider does not test your application for flaws such as broken access control or injection. That remains your job, and a pentest covers it.
Sources
Where this comes from
Related
Terms that sit next to this one
Shared responsibility model
The split between what your cloud provider secures and what you must secure yourself.
Cloud misconfiguration
A cloud setting left unsafe, such as open storage or an overly broad permission.
Multi-cloud security
Keeping controls consistent when you run across more than one cloud provider.
Cloud penetration testing
Testing cloud accounts and services for weaknesses, within the provider's rules.
Virtual private cloud
A private, isolated network space inside a public cloud account.
Who secures what in your cloud?
The provider secures the platform and you secure the application on it. We test the application and its APIs, and can run inside your own network so your code stays there. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.