Cloud security assigns controls and responsibilities across the provider, the customer, and any managed security service. Start with the specific cloud service and workload; a broad label does not establish what is protected.
What is The Cloud?
When people say “the cloud,” they usually mean one or more of these at once:
-
Infrastructure cloud (IaaS): VMs, networks, storage – AWS, Azure, GCP
-
Platform cloud (PaaS): managed runtimes, databases, functions – Azure App Service, AWS Lambda
-
Application cloud (SaaS): business apps – M365, Google Workspace, Salesforce
-
Data cloud : data stored, moved, or processed off-prem
Cloud security breaks down by where the control is applied and what it’s protecting.
Security of the cloud
“Is the cloud itself secure?”
The provider operates the underlying infrastructure within its service boundary. The division of responsibility varies by service; AWS’s shared-responsibility explanation illustrates why customers must evaluate the services they actually use.
Owned by the cloud provider
- Physical data centers
- Hypervisors
- Core networking
- Hardware lifecycle
Examples
- AWS securing its data centers
- Azure securing the virtualization layer
This is not what Network Box USA sells
Security in the cloud
“What’s running inside your cloud environment?”
Customers retain responsibilities for their workloads, identities, data, and configuration according to the selected service.
Includes these:
- VM security (EDR/XDR)
- Cloud workload protection (CWPP)
- Identity & access (IAM misuse, credential theft)
- Misconfigurations (open S3 buckets, exposed RDP)
- East-west traffic inside the cloud
- Logging, detection, response
Tools / Capabilities:
- EDR / XDR on cloud workloads
- SIEM ingestion of cloud logs
- SOC monitoring
- Threat hunting
- Incident response
Network Box USA can provide managed protection and monitoring within the agreed workload and telemetry scope. Confirm supported operating systems, integrations, event sources, and response actions.
This is often called:
- Cloud workload security
- IaaS / PaaS security
- Cloud detection & response (CDR)
Security for the cloud
“Controls designed specifically to protect cloud usage”
This is cloud-aware security, not just lifted from on-prem.
Includes these:
- CSPM (Cloud Security Posture Management)
- Identity-first security
- Policy enforcement
- Configuration drift detection
- Secure baselines across tenants
Examples:
- Detecting misconfigured storage
- Enforcing MFA
- Monitoring admin activity
- Preventing privilege escalation
This is the layer people think CASB covers, but this is broader.
This list describes cloud-security control categories. It is not a claim that every category is a native Network Box feature; verify the specific controls, products, and operating responsibilities in your proposal.
Security through the cloud
“Security that is delivered via cloud infrastructure”
This is about how the security service itself is provided.
The cloud is the platform used to deliver protection , visibility, and response.
This includes:
- Cloud-hosted SOC tooling
- Cloud-native detection engines
- Centralized cloud analytics
- Cloud-delivered updates and intelligence
- Global cloud-based visibility and response
Importantly:
- Security is not tied to a physical appliance
- Not bound to a customer’s location
- Delivered as a service
Network Box uses cloud-delivered operations and intelligence alongside the architecture selected for the customer. Physical gateways, endpoint software, cloud services, and customer-owned controls may each have a role.
This is sometimes (poorly) labeled:
- “Cloud-delivered security”
- “Security as a Service”
- “Platform-based security”
Security around the cloud
“What touches the cloud?”
Security that connects users, endpoints, and environments to cloud-delivered protection
- Endpoints reporting to cloud SOC
- Secure hybrid networks
- Remote users
- Branch offices
This is where identity + endpoint + network converge.
Agree how Network Box SOC operations connect to the customer’s identity, application, network, and recovery owners.
A practical cloud-coverage record
For each workload, record its cloud service, business owner, exposed interfaces, identity provider, supported security controls, collected logs, response permissions, and recovery owner. For example, a hosted application may have a provider-operated physical layer, customer-managed accounts and configuration, and a separately scoped managed monitoring service. Verify each handoff instead of assuming that protection of one layer establishes protection of all layers.
Review NBX detection and response, included SIEM coverage, and web application protection against that record.