What ‘the cloud’ actually is, explained through a café

Your email, your booking system and your accounting software probably live “in the cloud”. That phrase sounds like your files are floating somewhere overhead. They’re not. They’re sitting on very real computers in very real buildings.

So what does it actually mean, and which jobs are still yours? Here’s the cloud, if computing were a café.

Renting the kitchen instead of building one

Imagine opening a café without owning an oven. Instead, you rent space in a big commercial kitchen down the road. The owner keeps the lights on, fixes the coolroom and locks the building at night. You turn up, cook and pay for the space and time you use.

That’s the cloud. The US standards body NIST defines it as on-demand network access to a shared pool of computing resources. That means servers, storage, applications and services. They can be set up and released quickly, with little effort from you or the provider.

The old way was a server in the back office. You bought it, cooled it, patched it and replaced it. With the cloud, someone else owns the building and the gear. You rent a slice of it through the internet.

Ready meals or a bare bench

Not every rented kitchen is the same deal. Microsoft describes three main kinds.

• Software as a service is the ready meal. You use a finished application, such as Microsoft 365, over the internet. The provider runs nearly everything underneath.
• Infrastructure as a service is the bare bench. You rent the raw computing and run your own systems on it. You manage much more yourself.
• Platform as a service sits in between. It’s a prepped station for people who build their own apps.

That first kind is the one owners meet most often. Online email, accounting, file storage and booking apps you simply log into work this way.

The kitchen has an address

“Someone else’s computer” still has to be somewhere. Cloud providers run data centres in particular places, and they group them into regions.

Microsoft lists Azure regions in New South Wales, Victoria and Canberra. Google Cloud has regions in Sydney and Melbourne. For Google Cloud services, Google says the region you choose controls where that data is stored and used.

Microsoft also lists Australia as one of its local region geographies for Microsoft 365. A Data Location card in the Microsoft 365 admin centre shows where your own organisation’s data is stored.

Why care? ASD’s Australian Cyber Security Centre says to only use cloud services located in countries that suit how sensitive your data is. That includes where the provider’s support staff are.

The landlord fixes the building, you lock your pantry

Here’s the bit owners miss. Moving to the cloud doesn’t hand over all the security. It’s shared, and the ACSC calls this the shared responsibility model.

The provider looks after the building. Microsoft says it secures the physical data centres, network and servers. The ACSC says a provider is responsible for services that are securely designed, set up and run, including the infrastructure underneath.

Your side never goes away. Microsoft says that whatever kind of cloud you use, you always own your data and your accounts. That means who gets a login, who has access, multi-factor authentication and the devices people sign in from.

In café terms, the landlord fixes the coolroom and locks the front door. You still decide who gets a key to your pantry. If you leave the pantry key under the mat, that’s on you.

The ACSC is blunt about the stakes. You carry the risk of your data being stolen, changed or lost. That risk can mean financial loss, reputational damage and legal issues. You can’t outsource it.

Your share of the jobs

The ACSC lists what can fall to the customer, depending on the service. For a small business, the big ones are:

• Strong sign-in. It recommends phishing-resistant multi-factor authentication for cloud services.
• Only the access people need. Your casual barista doesn’t need the keys to the accounts.
• Trusted devices. Only use devices you trust to get into and manage your cloud services.
• Settings that are actually safe. Default settings, including logging, may not be secure enough for your needs.

Then there’s backups. A backup might be included, sold as an extra or left to you. Ask your provider which one applies, and test that you can actually restore from it. Our guide to backing up Microsoft 365 and Google Workspace walks through the main options.

When the kitchen has a bad day

Two kinds of trouble are worth planning for.

The first is a break-in through your own door. One example: a criminal gets into your cloud account and deletes your files. The provider’s building was fine. Your login wasn’t. That’s why it suggests checking whether a provider alerts you when someone signs in from an unfamiliar device.

The second is the provider having a bad day. Google designs its zones so a power, cooling or network outage is unlikely to hit more than one at once. It recommends spreading systems across zones and regions, so one failure doesn’t take everything down.

Even so, be ready to act quickly on security alerts. Know how to contact your provider, and how much help they’ll give.

Pick a landlord who does more of the work

One ACSC tip is simple. Providers typically have substantial resources and know-how. So choose services where the provider carries more of the security load.

Its example is your website. Use a trusted website service rather than running your own web server. It also says to pick services that are secure “out of the box”, with protections built in at no extra cost.

Checklist

• List every cloud service your café uses. Include email, accounting, bookings, file storage and your website.
• Turn on multi-factor authentication for each one. Use the strongest option offered; the ACSC recommends phishing-resistant methods.
• Check who has access. Remove former staff and give everyone else only the access their job needs.
• Ask each provider who backs up your data. Find out whether backups are included, cost extra or are up to you.
• Test a restore. Recover one deleted file or old version to prove your backups actually work.
• Check where your data is stored. In Microsoft 365, open the Data Location card in the admin centre; for other services, ask the provider.
• Check for sign-in alerts. Ask each provider whether it warns you about logins from unfamiliar devices, and turn it on if so.