This article is based on a case study originally published on csoonline.com, featuring Steve McAtee, CIO of Vibrant Credit Union (VCU).
Cloud Security Is Everyone’s Problem Now
Cloud computing promises significant cost savings and more streamlined management of mission-critical IT workloads, data processing, and storage. But as organizations move sensitive data and applications off-premises, the question of how to keep that data secure becomes critical.
Vibrant Credit Union (VCU), a Midwestern full-service financial institution offering both online services and physical branches, provides a useful case study. As VCU expanded its cloud footprint on Amazon Web Services (AWS), CIO Steve McAtee was tasked with migrating securely without inflating the IT budget. His team discovered that continuous monitoring and automation were the keys to improving security posture while simultaneously eliminating the pain of annual regulatory compliance audits.
Their experience surfaced five key considerations that apply broadly to any organization planning a secure cloud migration.
1. The Speed Factor
One of the most immediate benefits of cloud adoption is elasticity: the ability to spin resources up or tear them down on demand. This enables continuous development and rapid software releases. However, speed creates a security risk if development velocity outpaces your security practices.
When infrastructure is provisioned and deprovisioned rapidly, misconfigurations, exposed storage buckets, and overly permissive IAM roles can be introduced just as quickly. Security must be embedded into the pipeline — not bolted on afterward — to keep pace with development speed.
- Integrate security scanning into your CI/CD pipeline.
- Enforce infrastructure-as-code (IaC) policies to catch misconfigurations before deployment.
- Use automated guardrails rather than relying on manual reviews that can’t match deployment cadence.
2. The Cost Factor
Cloud adoption converts capital expenditure — physical servers, data center space, power, cooling, hardware maintenance — into operational expenditure based on consumption. VCU was able to eliminate the fixed costs of provisioning and maintaining on-premises data centers and shift to a flexible, pay-as-you-go model.
From a security perspective, this shift also changes the economics of security tooling. Many cloud-native security controls (such as AWS CloudTrail, AWS Config, and AWS Security Hub) are available at relatively low cost. The challenge is not the cost of individual tools, but ensuring your team has the expertise to configure and act on them effectively.
The bottom line: cloud can reduce overall IT costs, but only if the security investment scales proportionally. Skimping on security tooling to preserve cost savings is a false economy.
3. The Security Factor
In the cloud, rebuilding a compromised server is technically easier than in a traditional data center. But rebuilding a server does not undo the damage of a data breach. Once data has been exfiltrated, the consequences — legal, regulatory, financial, and reputational — are the same regardless of where the infrastructure was hosted.
The cloud’s global reach amplifies the attack surface. Data is moved, processed, stored, and accessed across regions and devices — including mobile endpoints — which increases exposure. Adversaries increasingly use automation: attack tooling runs continuously, scanning for misconfigured resources, open ports, and exposed credentials.
VCU’s response was to fight automation with automation. Rather than relying on periodic manual reviews, they implemented continuous security monitoring of their AWS environment to surface vulnerabilities before attackers could exploit them. The key insight: if attackers are operating programmatically around the clock, your defenses need to operate the same way.
4. The Compliance Factor
A common misconception is that moving to a managed cloud provider transfers compliance responsibility. It does not. Under most regulatory frameworks — PCI DSS, HIPAA, SOC 2, GDPR, and financial industry regulations — the organization remains responsible for the security of its data regardless of where it is stored or processed.
Cloud providers operate under a shared responsibility model: the provider is responsible for the security of the cloud (physical infrastructure, hypervisors, network fabric), while the customer is responsible for security in the cloud (data, access controls, operating system configuration, application security).
Proving compliance in a dynamic cloud environment through manual audits is impractical. Even a modest AWS environment can have hundreds of configuration points that auditors need to review. VCU combined compliance and security expertise into a unified team and supported that team with automated security tooling capable of continuously monitoring the environment and generating evidence for auditors on demand.
- Map your compliance framework controls to cloud provider native controls and third-party tooling.
- Automate evidence collection to reduce the burden of point-in-time audits.
- Treat compliance as a continuous state, not an annual event.
5. The Automation Factor
Manually auditing cloud infrastructure is not sustainable. Discovery, configuration review, vulnerability assessment, remediation, and reporting can consume significant engineering time — time that grows proportionally with the size and complexity of the environment.
VCU estimated that without automation, maintaining baseline security across their cloud accounts would effectively consume one or more full-time staff members just to maintain the existing security state — without making any improvements. Implementing more advanced controls or additional compliance frameworks would require even more headcount.
Automation solves this problem by continuously running the checks, comparisons, and alerts that would otherwise require human effort. It enables a small team to operate at the scale that cloud infrastructure demands.
Practical starting points for cloud security automation include:
- Configuration drift detection: Continuously compare live infrastructure against approved baselines (e.g., AWS Config Rules, Azure Policy).
- Automated remediation: Use event-driven functions (e.g., AWS Lambda) to auto-remediate known-bad configurations such as publicly accessible S3 buckets.
- Continuous vulnerability scanning: Integrate scanning into pipelines and production environments to surface new CVEs as they are disclosed.
- Centralized alerting and dashboards: Aggregate findings from multiple tools into a single pane of glass so the security team can prioritize effectively.
Bringing It Together: Continuous Security in the Cloud
The experience of Vibrant Credit Union illustrates a broader truth: moving to the cloud does not inherently make you less secure. In fact, with the right approach, it can improve your security posture. The cloud provides access to security tooling and automation capabilities that would have been cost-prohibitive to build and operate on-premises for many organizations.
The five factors above — speed, cost, security, compliance, and automation — are not independent concerns. They are deeply interconnected. Speed without security automation creates risk. Cost savings achieved by cutting security investment are illusory. Compliance achieved through annual manual audits does not reflect the reality of a continuously changing cloud environment.
The organizations that succeed in the cloud are those that adopt a continuous mindset: continuous monitoring, continuous compliance, and continuous improvement of their security controls. With a small team and limited resources, VCU was able to achieve this by leaning on automation — and that approach is available to any organization willing to invest in it.