The main public cloud security risks are unclear shared responsibility, misconfiguration, weak identity and access control, exposed data and loss of visibility. Most come from how a customer configures and operates services, not from the provider's data centers, so the fixes are largely in your hands.
What does NIST say about the public cloud?
NIST SP 800-144 gives an overview of security and privacy challenges in public cloud computing and considerations for organizations outsourcing data, applications and infrastructure. It describes the model as the displacement of data and services from inside the organization to outside it. That shift is the root of most risks: you give up direct control of some layers while remaining accountable for your data.
The NIST definition in SP 800-145 describes cloud computing as on-demand access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort. Rapid provisioning is also rapid mistake making.
Which risks come up most?
Shared responsibility confusion. The provider secures the underlying facilities and platform. You secure what you put on it: configuration, identities, data and applications. The split changes between infrastructure, platform and software services, so read the provider's documentation for each service you use.
Misconfiguration. A storage bucket set to public, a security rule open to the whole internet or a disabled log are one click each. Rapid provisioning means mistakes spread quickly, and infrastructure as code can copy a bad default into every environment.
Identity and access. Cloud accounts are reachable from the internet, so a stolen credential is a front door. MITRE ATT&CK lists Cloud Accounts as a sub-technique of Valid Accounts, and recommends MFA across all account types.
Data exposure. Data moves between services, regions and third parties. If you cannot say where sensitive data lives, you cannot protect it.
Multi-tenancy. The UK NCSC cloud security principles include separation between customers: a malicious or compromised customer of a service should not be able to access or affect another customer's service or data. That is the provider's job, and you should ask how they show it.
Visibility and logging. Short log retention, missing audit trails or logs in another team's account make incidents hard to investigate.
Vendor dependence. Moving data and workloads out can be hard, and an outage at the provider is an outage for you.
A constructed example
A team moves a reporting tool to a managed database. The database is reachable from a shared network, and the default security rule allows access from anywhere inside the account. Another team's test instance, running an old library, is compromised and used to query the database. No provider failure was involved. The risk was in a default left unchanged and a network rule broader than needed.
What protects data in transit?
The NCSC's first principle is data in transit protection: data should be adequately protected against tampering and eavesdropping as it moves across networks inside and outside the cloud, using a combination of encryption, service authentication and network level protections. Apply it between your users and the cloud, and between services inside it.
How to check or apply this
- Write down, per service, who is responsible for each layer.
- Turn on provider audit logging in every account and keep it long enough to investigate.
- Require MFA for all human accounts and use short lived credentials for workloads.
- Scan infrastructure definitions and live configuration for public exposure and open rules.
- Classify data and record where each class lives.
- Encrypt data in transit and at rest and manage keys deliberately.
- Review the provider's assurance documents against the NCSC principles.
Quick check
Who is responsible for cloud security?
Both parties, for different layers. The provider secures the platform. You secure your configuration, identities, data and applications. The split varies by service type.
Is public cloud less secure than on premises?
Not inherently. Risk depends on configuration and operation. Cloud makes mistakes faster to make, and good practices faster to automate.
Sources
- NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing
- NIST SP 800-145, The NIST Definition of Cloud Computing
- UK NCSC, The cloud security principles
- MITRE ATT&CK T1078, Valid Accounts
Last reviewed: 18 October 2026.
