Cloud and platforms, explained simply
The cloud is someone else's computers that you rent. They look after the building; you look after what you put inside.
The big idea
Renting a flat is a good way to picture the cloud. The landlord looks after the building: the roof, the walls, the front door of the block. You look after your own flat: you lock your door, you decide who gets a key, and you don't leave the window open when you go out.
The cloud company is the landlord. It looks after the building: the roof, the walls, the front door of the block and the lift. It is very good at this half.
Pick a half to see who looks after what.
Cloud providers such as Amazon, Microsoft and Google work the same way, and they call it shared responsibility. They are very good at their half. Almost every big cloud break-in happens in the customer's half: an account with only a password, a secret key left in some code that anyone can read, or storage set so the whole internet can see it.
Almost every big cloud break-in happens in your half: a door with only a password on it, a key left lying in some code, storage left open to the whole internet.
The fix is not to buy more alarms after the fact. It is to set safe defaults from the start, so every new flat comes with the door already locked and the windows already shut. In most organisations a platform team builds those starting points, and everyone else builds on top of them.
Without safe defaults, every new flat starts with the window open and the key under the mat, and each tenant has to remember to fix it.
Pick one to compare.
Words you will meet
- Cloud: computers, storage and services you rent from a provider over the internet instead of owning.
- Shared responsibility: the provider secures the cloud itself; the customer secures what they put in it and how they set it up.
- Misconfiguration: a wrong setting, such as storage left open to everyone.
- Multi-factor authentication or MFA: signing in with something extra as well as a password, such as a code on your phone.
- Platform team: the people who build the standard, safe starting point that everyone else uses.
The field notes, in plain words
- Shared responsibility still fails at the same seam
The cloud company looks after the building; you look after what you put in it, and most break-ins happen at the door you were meant to lock.
Ready for more? Cloud and platforms: where things stand
Personal work and my own view, not my employer's. Sources are public.