Overview
The cloud has changed the way organisations operate. Business applications, customer information, collaboration platforms and critical workloads can now be accessed from almost anywhere, giving organisations greater flexibility and scalability.
But there is an important misconception about cloud adoption: moving to the cloud does not automatically make an organisation secure.
Cloud providers secure parts of the environment, but customers continue to have their own security responsibilities. The Australian Cyber Security Centre describes this as the shared responsibility model, where responsibilities are divided between the cloud provider and the customer depending on the cloud service being used.
Understanding where those responsibilities sit is fundamental to good cloud security.
Security Doesn’t End with the Cloud Provider
A cloud provider may operate highly secure infrastructure, but the way an organisation uses that infrastructure also matters.
Access permissions, user accounts, business data, connected applications, devices and security configurations all need to be appropriately managed. Australian Government guidance notes that organisations retain responsibilities for areas including their data, devices, cloud resource access and incident response.
This means an organisation can use a secure cloud platform and still introduce risk through its own configurations or access decisions.
The better question is not“Is our cloud provider secure?”
It is“Are we using and managing our cloud environment securely?”
Identity and Access Have Become Critical
Cloud technology has changed where people work and how they access information.
Employees can connect to business systems from different locations and devices. Contractors, partners and suppliers may also require access to certain cloud resources.
As a result, organisations need clear visibility over who has access and whether that access is still necessary. The ACSC recommends giving people only the cloud access they need as part of the customer’s cloud security responsibilities.
As an organisation grows, access should evolve with it. Someone changing roles should not automatically retain every permission they previously had, and access should be addressed when people leave the organisation.
Cloud security therefore increasingly begins with identity, access and accountability.
Protecting the Cloud Means Understanding Your Data
Another important question is surprisingly simple:
Do you know where your important business data is?
Information may be distributed across cloud infrastructure, business applications, collaboration platforms and third-party services.
The ACSC recommends that organisations understand which cloud services and providers they use, manage risks according to the sensitivity of their data, and maintain visibility over relevant third-party security risks.
For business leaders, this makes cloud security as much a data governance discussion as a technology discussion.
If an organisation cannot clearly understand where sensitive information resides, who can access it and which services interact with it, managing risk becomes considerably harder.
Cloud Environments Don’t Stay the Same
A cloud environment can change significantly after its initial implementation.
New users are added. Applications are connected. Permissions change. New workloads are deployed. Suppliers are given access. Business requirements evolve.
This is why a cloud security review shouldn’t only happen during a migration.
Organisations should periodically reconsider whether their current security controls still reflect their actual technology environment, information sensitivity, governance obligations and risk appetite. The ACSC recommends organisations at least maintain, and ideally improve, their cyber security posture when using cloud services.
Cloud security should evolve as the organisation evolves.
Security Is Also About What Happens When Things Go Wrong
Strong cloud security isn’t only about prevention.
Organisations also need to be prepared to respond when something unexpected happens.
The impact of losing access to critical data or cloud services can extend quickly beyond the IT department. Business operations, employees and customers may all be affected.
Incident response is specifically identified by the ACSC as an area where cloud customers retain responsibilities.
This makes resilience an important part of the cloud conversation.
Organisations should understand not only how they are protecting their environment, but also how they would respond if an account were compromised, information became unavailable or a critical service was disrupted.
Cloud Security Starts with Visibility
A business does not necessarily need another security product simply because it is concerned about cloud risk.
The better starting point is understanding the environment that already exists.
Leadership and technology teams should be able to clearly answer:
- What cloud services are we using?
- Where is our sensitive information stored?
- Who has access to that information?
- Are users receiving only the access they need?
- Which responsibilities belong to us and which belong to our providers?
- What third parties are connected to our cloud environment?
- Are our security controls keeping pace with changes to the business?
- Are we prepared to respond when something goes wrong?
If those questions are difficult to answer, visibility is the first problem to solve.
A Secure Cloud Is a Well-Managed Cloud
Cloud security isn’t simply about where technology is hosted.
It is about how identities, information, access, configurations and responsibilities are managed around that technology.
As organisations expand their use of cloud services, the strongest approach is to understand the environment, know where responsibilities sit and continuously align security with business risk.
Because ultimately, being in the cloud and being secure in the cloud are not the same thing.