CYBERSECURITY A-Z

Cloud Network Security

What Is Cloud Network Security?

Cloud network security is the combined use of technologies, policies, controls, and processes to protect cloud-based networks from threats like data breaches, misconfigurations, and distributed denial-of-service (DDoS) attacks. Its goal is to secure critical assets – an including data, applications, virtual machines, and infrastructure – across public, private, hybrid, and multi-cloud environments. By focusing on securing network traffic, endpoints, virtual private clouds (VPCs), and connections between cloud and on-premises systems, cloud network security helps prevent unauthorized access, data loss, service disruptions, and performance degradation.

The importance of cloud network security is directly correlated to the convenience and popularity of cloud infrastructure and usage. Gartner forecast that by 2025:

  • More than 85% of organizations will adopt a cloud-first strategy, meaning they prioritize cloud technologies for new and existing workloads
  • 95% of new digital workloads will be deployed on cloud-native platformsi

This rapid shift to cloud creates a dynamic and highly distributed IT surface that traditional security tools often struggle to protect.

 

Why Cloud Network Security Matters: Common Vulnerabilities in Cloud Environments

In today’s digital landscape, organizations increasingly rely on the cloud to drive innovation and efficiency. The global cloud market is projected to reach $1.26 trillion by 2028, making it more important than ever to understand the cloud and the associated risks.ii

At its core, using cloud-based technologies enables organizations to run software and services over the internet, with data stored in cloud environments usually managed by third-party cloud providers. This model offers scalability, flexibility, and cost-efficiency. But it also introduces a new set of security challenges.

While cloud environments are not inherently less secure than traditional on-premises systems, they do come with unique vulnerabilities. Consider that in 2023, 80% of data breaches involved cloud-stored information.iii

This underscores the importance of cloud network security.

Note: it’s important to distinguish between risks and threats:

  • Risks refer to what’s vulnerable—data, systems, or infrastructure—and what could potentially be lost if these areas are exploited.
  • Threats are the actual actions or attacks an adversary could carry out to exploit those risks. Key threats include insider attacks, DDoS attacks, and advanced persistent threats (APTs).

Without the right safeguards, cloud networks can become prime targets for cybercriminals. Cybercriminals are targeting cloud networks with growing precision, using tactics like lateral movement, privilege escalation, and cloud misconfigurations to gain access.

The Cloud Security Alliance notes the folloare among the most common causes of cloud breaches. The 2022 rankings appear in parentheses to show the change over timeiv:

  1. Misconfiguration and inadequate change controI (#3)
  2. Identity and Access Management (IAM) (#1)
  3. Insecure interfaces and APIs (#2)
  4. Inadequate selection/Implementation of cloud security strategy (#4)
  5. Insecure third-party resources (#6)
  6. Insecure software development (#5)
  7. Accidental cloud data disclosure (#8)
  8. System vulnerabilities (#7)
  9. Limited cloud visibility/Observability
  10. Unauthenticated resource sharing
  11. Advanced persistent threats (#10)

Here are three examples of how cybercriminals can exploit these flaws:

  • Misconfigured settings: When default configurations prioritize convenience over security, they leave openings for attackers.
  • Overly broad access controls: Granting excessive permissions creates easy pathways for unauthorized access.
  • Weak encryption practices: Improperly encrypted data can be intercepted and stolen.

 

Relationship Between Cloud Network Security and Cloud Security

Cloud network security is a critical subset of the broader concept of cloud security. While cloud security encompasses a wide range of practices aimed at protecting data, applications, and infrastructures in the cloud, cloud network security focuses on safeguarding the network aspects of cloud environments. This includes securing data transmission, managing access controls, and ensuring network integrity.

 

How Does Cloud Network Security Work?

As explained in our Cloud Security glossary page, when it comes to securing cloud environments, the cybersecurity industry widely accepts the principle that doing so is a shared responsibility. Promoted by the Cloud Security Alliance (CSA), ‘shared responsibility’ clearly defines who is responsible for what in the cloud:

  • Cloud Service Providers (CSPs) like AWS, Azure, and Google Cloud are responsible for securing the core infrastructure: physical data centers, network components, and the virtualization layer.
  • Cloud Service Customers (CSCs) are responsible for securing everything built on top of that infrastructure, including their operating systems, applications, and data. This means setting up configurations properly, managing user access, and staying current on patches and updates.

The CSC’s level of responsibility depends heavily on the model. Three common models are:

  • Software as a Service (SaaS): In SaaS, the MSP handles most security tasks, while the CSC uses the application (e.g., email platforms, office productivity suites, and CRM tools). The CSC’s responsibilities focus on user access, data security, and configuration settings within the application.
  • Platform as a Service (PaaS): PaaS eqips a pre-built environment for developing, testing, and deploying applications. The MSP manages the platform itself, but the CSC is responsible for securing the code and applications they create, as well as managing access to those services.
  • Infrastructure as a Service (IaaS): With IaaS, CSCs essentially rent the raw power of infrastrucutre – virtual machines, storage, and networking. That means they take on the most responsibility – from configuring operating systems and managing middleware to securing third-party applications and user access.

Regardless of the model used, the takeaway is the same: security in the cloud is a shared effort. The CSP secures the cloud infrastructure, and the CSC secures what they build in it. This clear division of responsibilities not only helps reduce risk, but it also encourages strong collaboration between MSPs and customers – ensuring that every layer of the cloud is protected.

 

Best Practices

To effectively secure cloud networks, organizations can adopt the following best practices:​

  1. Implement strong access controls: According to the Cybersecurity and Infrastructure Security Agency (CISA), implementing granular access permissions and regularly revoking unneeded access are critical practices to mitigate risks associated with expanding roles within cloud infrastructures.v With that in mind, enforce the principle of ‘least privilege’ by granting users only the access necessary for their roles. Regularly review and update access permissions.​
  2. Encrypt data in transit and at rest: Use robust encryption protocols to protect sensitive data during transmission and storage.​
  3. Regularly monitor and audit networks: Continuously monitor network traffic for unusual activities and conduct regular audits to ensure compliance with security policies.​
  4. Establish incident response plans: Develop and regularly update incident response strategies to address potential security breaches promptly.​
  5. Stay updated with security patches: Regularly apply security patches and updates to all systems and applications to mitigate vulnerabilities.​

These practices align with the Cybersecurity Framework (CSF) published by The National Institute of Standards and Technology (NIST).vi CSF helps organizations manage and reduce security risk through six high-level, outcome-driven functions:

  1. GOVERN (GV). This is the strategic backbone. Organizations define and communicate their policies, risk appetite, and roles, embedding security into broader enterprise risk management. GOVERN guides and prioritizes all other functions based on mission and stakeholder needs.
  2. IDENTIFY (ID). Know what you’re protecting. This function focuses on understanding assets—data, systems, people, suppliers—and the risks tied to them. It sets the stage for informed decision-making and helps identify gaps in policies, processes, and practices.
  3. PROTECT (PR). Put safeguards in place. PROTECT covers measures like access control, encryption, employee training, and infrastructure hardening to prevent or reduce the impact of cyber threats.
  4. DETECT (DE). Spot trouble early. This function ensures organizations can detect anomalies, threats, and indicators of compromise quickly, enabling a faster, more effective response.
  5. RESPOND (RS). Take action fast. RESPOND helps organizations contain and manage incidents through structured processes for mitigation, analysis, reporting, and communication.
  6. RECOVER (RC). Bounce back stronger. RECOVER focuses on restoring affected systems and operations, minimizing downtime, and ensuring stakeholders are informed throughout the recovery process.

These practices also help address today’s cloud network security challenges in line with NIST SP 800-210.vii While the NIST CSF offers a risk-based model that applies to cloud networks, NIST SP 800-210 focuses on access control in cloud systems.

In addition, Gartner offers a cloud security architecture guide that includes industry best practices, real-world insights, and expert recommendations.viii The guide serves as a valuable resource for security and risk management leaders aiming to enhance their cloud security posture.

 

What Types of Cloud Network Security Solutions Are Available?

Organizations have many options to choose from when securing their cloud environment. The most effective approach is using a layered defense that combines preventive, detective, and corrective controls:

  • Preventive: These measures aim to prevent unauthorized access and include implementing firewalls, intrusion prevention systems, and strong authentication protocols.​
  • Detective: These involve monitoring and logging activities to detect anomalies or potential security incidents, using tools like intrusion detection systems and SIEM solutions.​
  • Corrective: These actions address and mitigate the impact of security incidents, such as implementing incident response plans and applying patches or updates to unprotected systems.​

Organizations often incorporate solutions from the following categories into their cloud network security strategy:

Cloud Security Posture Management (CSPM).  Instead of scanning for external attacks like SIEM, CSPM tools look inward – spotting misconfigurations, unsecured interfaces, and compliance gaps. These tools are essential for maintaining a healthy, hardened cloud environment and meeting regulatory standards.

Data Loss Prevention (DLP). DLP tools extend the idea of CSPM to data. They enforce rules about how data can be accessed, shared, and stored, and alert administrators when those rules are broken. This prevents sensitive information from leaking due to human error or insider threats. With growing teams and third-party vendors, automation through DLP becomes critical to ensure policies are being followed.

Identity and Access Management (IAM). IAM tools determine who can access what within a cloud environment. They give administrators centralized control over user permissions and typically rely on practices like role-based access control (RBAC) and multi-factor authentication (MFA). A key concept here is the principle of least privilege: users are given the minimum access needed to do their jobs, reducing the risk of accidental or malicious misuse.

Multi-Factor Authentication (MFA). This adds an extra layer of security by requiring users to verify their identity with two or more credentials, such as a password plus a one-time code or fingerprint. It makes it much harder for attackers to gain access, even if login details are compromised.

Network Segmentation. Network segmentation divides a larger network into smaller, isolated segments to improve security and control. By restricting access between segments and isolating workloads, it limits the spread of threats, enhances visibility, and helps protect sensitive systems from unauthorized access.

Public Key Infrastructure (PKI). PKI is a core building block of trusted communication in the cloud, helping ensure that cloud communications are authentic and secure. By using public key encryption and digital certificates, PKI validates server identity, whether someone is directly connecting to a website or using a VPN.

Secure Access Service Edge (SASE). SASE is a cloud-native security model that combines networking and security functions into a single framework, helping organizations move away from scattered, legacy tools. SASE acts as a protective layer between users and cloud applications, enabling secure access from anywhere, on any device.

Security Information and Event Management (SIEM). SIEM tools automatically collect, monitor, and analyze security data in real time using machine learning or statistical models to spot unusual activity. Often paired with Intrusion Detection and Prevention Systems (IDPS), SIEM helps stay ahead of attacks by flagging threats before they do damage.

Virtual Firewalls. Virtual firewalls are software-based security tools that protect cloud and virtual environments by monitoring and controlling traffic between systems. They enforce security policies just like physical firewalls but are designed to run in virtualized infrastructure, making them ideal for dynamic, cloud-native networks.

Zero Trust Solutions. Zero Trust solutions operate on the principle of “never trust, always verify.” Instead of assuming users or devices inside the network are safe, they continuously authenticate and authorize every access request. This minimizes the risk of lateral movement by attackers and strengthens overall security posture. that assume no user or device is inherently trusted

These solutions align with guidance from CISA and the National Security Agency (NSA) on how to  improve the security of cloud environment(s)ix:

  • Use secure cloud identity and access management practices
  • Use secure cloud key management practices
  • Implement network segmentation and encryption in cloud environments
  • Secure data in the cloud
  • Mitigate risks from managed service providers (MSP) in cloud environments

 

How Does Forescout Help?

As organizations continue to embrace the cloud, implementing robust cloud network security measures becomes imperative. Forescout offers comprehensive solutions to enhance cloud network security:​

  • Automated Incident Response: Forescout offers tailored responses to security incidents through automated actions and continuous compliance assessments. It monitors all connected assets across diverse networks for noncompliance or unusual behavior and can automatically quarantine compromised devices.
  • Continuous Monitoring: Forescout continuously monitors network assets, assessing their security posture in real time. It identifies any new devices joining the network and ensures they comply with security policies. This continuous monitoring helps detect and respond promptly to potential security threats.
  • Cyber Asset Inventory: The Forescout Platform collects data on device type, manufacturer, OS configuration, applications installed, patch state, network location, logged-in users, vulnerabilities, criticality and what it’s communicating with. All of this can be continuously synchronized with your configuration management database (CMDB), such as ServiceNow, to prove a wealth of contextual information as assets join and leave the network and accelerate incident response.
  • Network Access Control (NAC): Can automatically detect non-compliant devices and either prevent them from joining the network or shut down switch ports if a non-compliant device is connected.
  • Network Segmentation: The Forescout Platform accelerates the design, planning and deployment of dynamic network segmentation. Visualize traffic flows to see what should and shouldn’t be communicating and simulate policy changes to avoid gaps and misconfigurations – without causing business disruption.
  • Next-Gen SIEM/Threat Detection & Response: Forescout Threat Detection & Response combines vendor- and EDR-agnostic support for 180+ data sources with predictable, endpoint-based pricing; automated data normalization and enrichment; 1,500+ verified rules and models; and a two-stage threat detection engine to weed out false positives and identify true threats.
  • Risk and exposure management (REM): Discovers and gives visibility to all cyber assets by continuously assessing and quantifing the attack surface presented by these endpoint assets, mitigating risk and compliance exposure through prioritized remediations and automated enforcement.
  • Zero Trust Assurance: Monitors all network activity, granting least-privilege access to only what is needed while constantly looking out for anomalous or malicious behavior.

To learn more, visit Network Access Control – Forescout.

[i] Gartner (2021). Gartner Says Cloud Will Be the Centerpiece of New Digital Experiences, November 10, 2021. Accessed March 28, 2025 from the following source: https://www.gartner.com/en/newsroom/press-releases/2021-11-10-gartner-says-cloud-will-be-the-centerpiece-of-new-digital-experiences

[ii] Markets and Markets (2023). Cloud Computing Market by Service Model (IaaS, PaaS, SaaS), Deployment Model (Public Cloud, Private Cloud, Hybrid Cloud), Organization Size, Vertical (BFSI, Telecommunications, Manufacturing, Retail & Consumer Goods) and Region – Global Forecast to 2028, December 2023. Accessed March 28, 2025 from the following source: https://www.marketsandmarkets.com/Market-Reports/cloud-computing-market-234.html

[iii] Harvard Business Review (2024). Why Data Breaches Spiked in 2023, February 19, 2024. Accessed March 28, 2025 from the following source: https://hbr.org/2024/02/why-data-breaches-spiked-in-2023

[iv] Cloud Security Alliance (2024). Cloud Security Alliance Releases Top‌ ‌Threats‌ ‌to‌ ‌Cloud‌ ‌Computing 2024 Report, August 6, 2024. Accessed March 28, 2025 from the following source: https://cloudsecurityalliance.org/press-releases/2024/08/06/cloud-security-alliance-releases-top-threats-to-cloud-computing-2024-report

[v] CISA (2025). Cloud Security Technical Reference Architecture, June 2022. Accessed March 28, 2025 from the following source: https://www.cisa.gov/sites/default/files/2023-02/cloud_security_technical_reference_architecture_2.pdf

[vi] NIST (2024). The NIST Cybersecurity Framework (CSF) 2.0, February 26, 2024. Accessed March 28, 2025 from the following source: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf

[vii] NIST (2020). NIST SP 800-210, April 2020. Accessed March 28, 2025 from the following source: https://csrc.nist.gov/pubs/sp/800/210/ipd

[viii] Gartner (2025). A Blueprint for Building Cloud Security Architecture, January 21, 2025. Accessed March 28, 2025 from the following source: https://www.gartner.com/en/articles/cloud-security-architecture

[ix] CISA (2025). CISA and NSA Release Cybersecurity Information Sheets on Cloud Security Best Practices, March 7, 2024. Accessed March 28, 2025 from the following source: https://www.cisa.gov/news-events/alerts/2024/03/07/cisa-and-nsa-release-cybersecurity-information-sheets-cloud-security-best-practices

Demo RequestForescout PlatformTop of Page