secure tunnels

How do you put a firewall around cloud services? It’s nearly impossible to add the same protection you have for your internal network around these services. The real problem is, how can you protect what you don’t actually own?