Cloud computing and cybersecurity
Cloud computing gives businesses and public authorities flexible access to IT resources – but it also comes with security risks. The NCSC explains what needs to be considered in relation to data protection, maintaining control over data and systems, and contractual arrangements.
Cloud computing is an advanced form of IT outsourcing based on well-established principles. The technology brief mentioned in the section “further information” is intended to help IT managers in public authorities, businesses and educational institutions make informed decisions.
What is cloud computing?
Cloud computing allows organisations to access IT resources over a network. These resources are rented rather than purchased.
The NCSC's understanding of cloud computing is based on the five widely recognised characteristics defined by the US National Institute of Standards and Technology (NIST):
- On-demand self-service
Users can access services whenever they need them, without manual intervention by the provider. - Resource pooling
Physical resources are pooled and dynamically allocated among multiple users. - Rapid scalability
Resources can be adjusted automatically in response to changing demand. - Measurability
Resource use is continuously monitored, enabling transparent billing. - Access via the internet
Management access is provided via the public internet, with a distinction made between the management and system environments.
Service models and deployment models
Responsibilities are divided differently between the provider and the customer depending on the cloud model:
Cloud services can also be classified according to how they are deployed. Public clouds use shared infrastructure and are managed over the internet, while private clouds use dedicated hardware and have restricted management access.
Cybersecurity challenges
Using cloud services involves certain risks because organisations give up some physical control over their data:
- Loss of control
The organisation no longer has exclusive control of its data. An outage may result in temporary or even permanent data loss. - Gaps in cryptographic protection
Data can be effectively protected while it is being transmitted and stored, but protecting it during processing remains a challenge, particularly in the context of confidential computing. - Management access can be an attack surface
Because management interfaces are often accessible over the internet, misconfigurations or stolen API keys can put the entire infrastructure at risk. - Multi-tenancy
Because resources are shared among multiple customers, vulnerabilities in the provider's underlying infrastructure can potentially affect many customers at the same time.
What to consider before using cloud services
The NCSC has defined a three-stage assessment process to help determine whether a cloud service is suitable for a particular purpose.
Legal assessment
Data processing agreements (DPAs) must be in place. Where data is transferred abroad, an adequate level of data protection must be ensured.
Technical and organisational requirements
- Emergency planning
It must be possible to export the data and store it as an offline backup to protect it from ransomware. - Transparency
The provider must fully document security features such as multi-factor authentication (MFA), encryption (TLS/VPN) and access logging. - Reporting
There must be a transparent process in place for reporting incidents and vulnerabilities.
Key questions
- Can the legal requirements relating to data processing be met, such as those relating to official secrecy? If not, the cloud should not be used.
- How time-critical is the application? Its dependence on a stable internet connection must be taken into account.
- What would be the consequences of data loss or unauthorised access
- Does the organisation's IT department have the necessary level of maturity to handle the more complex monitoring required in a cloud environment?