Cloud platforms provide scalable infrastructure and managed services, but customers remain responsible for many security decisions. The exact division of responsibility varies by service model and provider. Misconfigured identity permissions, exposed storage, weak secrets management and incomplete logging are common sources of risk.
Understand shared responsibility
The provider secures underlying facilities and services according to the cloud model, while customers typically remain responsible for data, identities, access policies and workload configuration. In infrastructure services, customers manage more of the operating system and network stack than in fully managed SaaS. Confirm responsibilities for each service.
Identity and permissions
Use central identity, MFA and role-based access. Avoid permanent broad administrator permissions. Separate production and development accounts or subscriptions, use managed identities where available and review service principals, access keys and third-party application grants.
Network and workload protection
Limit public exposure, use private connectivity where appropriate and apply security groups or network policies with least privilege. Harden virtual machines and containers, patch images, scan dependencies and protect orchestration control planes. Store secrets in managed vaults rather than source code or build logs.
Data protection
Classify data, encrypt it in transit and at rest, restrict storage access and enable appropriate versioning and recovery features. Review public access settings, sharing links, retention and data residency requirements. Test deletion and recovery behaviour before relying on a service.
Cloud visibility and governance
Enable control-plane audit logs, workload telemetry and configuration monitoring. Use policy-as-code or guardrails to prevent risky deployments. Alert on public storage, privilege escalation, disabled logging, unusual key creation and changes to network exposure.
Secure delivery lifecycle
Integrate security checks into infrastructure-as-code and CI/CD workflows. Protect build agents, signing credentials and deployment tokens. Require peer review for high-risk changes and maintain a tested rollback path.
- Confirm the control has a named owner and documented business purpose.
- Validate configuration against current vendor guidance and organisational policy.
- Test expected and denied access paths; retain evidence of the result.
- Monitor exceptions, failures and configuration changes.
- Review the control after material infrastructure or business changes.
Cloud security is an operating discipline: clear ownership, least privilege, secure defaults, continuous configuration review and tested recovery.