This glossary defines 14 cloud security terms in plain words. NIST SP 800-145 supplies the official wording for the basic cloud models. For newer terms, where no standard exists, the entry says so. Use it as a quick reference and as a check on what a vendor means.
The basic models
Cloud computing. NIST's definition describes a model for on demand network access to a shared pool of configurable computing resources that can be provisioned with minimal management effort. It lists five essential characteristics: on demand self service, broad network access, resource pooling, rapid elasticity and measured service.
IaaS (infrastructure as a service). In NIST's words, the consumer can provision processing, storage, networks and other fundamental resources and run arbitrary software, including operating systems. You manage the operating system and everything above it.
PaaS (platform as a service). You deploy your own applications onto tools the provider supplies. You control the application and its settings, not the underlying infrastructure.
SaaS (software as a service). You use the provider's application. You manage your data, users and settings.
Public, private, community and hybrid cloud. These are NIST's four deployment models: open to the general public, used by one organization, shared by a community with common concerns, or a composition of two or more.
The security terms
Shared responsibility. Providers publish a split of who secures what. Roughly, they secure the underlying platform, and you secure what you put on it and how you configure it. The split moves with the service model, so read your provider's version for each service. It is a provider practice, not a NIST term.
Misconfiguration. A setting that exposes something unintentionally, such as a public storage bucket. A common cause of cloud exposure, because the defaults and the options are in your hands.
IAM (identity and access management). The system of users, roles and permissions deciding who can do what to which resource. In cloud environments, it is the control plane for security.
Least privilege. Granting only the access needed for a task. NIST SP 800-207 builds its zero trust model around granting access per request with minimum necessary permissions.
Workload identity. A way for software, not people, to prove who it is, ideally with short lived credentials. SPIFFE is one open standard for it.
Control plane vs data plane. The control plane is the set of APIs that create and configure resources. The data plane is the actual traffic and data. Compromise of the control plane can change everything.
CSPM (cloud security posture management). A category of tools that checks configuration against rules. A category label, not a standard.
Container. A packaged application with its dependencies, isolated at the operating system level. NIST SP 800-190 covers container risks, including image, registry, orchestrator and host concerns.
Immutable infrastructure. Servers are replaced, not patched in place. It reduces drift, since every instance is built from the same definition.
A constructed use of the glossary
A vendor says it offers "fully managed security for your cloud." Using the terms above, ask: which service model does that apply to, which part is shared responsibility, and does "managed" cover configuration of your IAM roles? Often the answer is "no", which is the gap the glossary helps you see.
How to check or apply this
- Write down which model (IaaS, PaaS, SaaS) each of your services uses.
- For each, record who secures which layer using the provider's documentation.
- Check IAM roles for least privilege at least quarterly.
- Replace long lived keys with short lived credentials where possible.
- Scan configuration for public exposure on a schedule.
- Include the control plane in your logging and alerting.
Quick check
Who is responsible for data in a SaaS product?
You are, in the sense of deciding who may access it and how it is configured. The provider secures the platform it runs on.
Is a container the same as a virtual machine?
No. Containers share the host operating system kernel, while virtual machines include their own operating system.
Sources
- NIST SP 800-145, The NIST Definition of Cloud Computing
- NIST SP 800-190, Application Container Security Guide
- NIST SP 800-207, Zero Trust Architecture
- SPIFFE Concepts
Last reviewed: 18 October 2026.
