From the earliest days of cloud computing, security has been the primary concern holding enterprises back from public cloud adoption. The instinct is understandable: handing control of infrastructure to a third-party provider feels inherently risky. But the reality is more nuanced — and more encouraging — than many IT leaders assume.
Public cloud vendors operate at a scale that allows them to staff large, dedicated security teams and invest continuously in cutting-edge protective technologies. Most individual organizations, even very large ones, cannot match that investment. Many security professionals now argue that a well-configured public cloud environment is more secure than the typical private data center.
That said, cloud security is not automatic. Misconfigurations, inadequate access controls, and gaps in the shared responsibility model remain leading causes of cloud-related incidents. Following proven best practices — and deploying the right tooling — significantly reduces your exposure. The eleven practices below cover the most important areas your team should address.
1. Understand Your Shared Responsibility Model
In a private data center, your organization owns every layer of security. In the public cloud, responsibility is divided between you and the provider — a division known as the shared responsibility model. Getting this wrong is one of the most common sources of cloud security gaps.
The exact split depends on the service model:
- IaaS (e.g., AWS EC2, Azure VMs): The provider secures the physical infrastructure, hypervisor, and network fabric. You are responsible for the operating system, middleware, runtime, application code, data, and identity management.
- PaaS (e.g., Azure App Service, Google App Engine): The provider additionally manages the OS and runtime. You are still responsible for your application code, data, and access controls.
- SaaS (e.g., Microsoft 365, Salesforce): The provider manages almost everything; you remain responsible for your data, user accounts, and access permissions.
Before committing to a cloud vendor, review their published shared responsibility documentation. AWS, Microsoft Azure, and Google Cloud all publish detailed guidance. Map their coverage against your security requirements to identify any gaps that your team must fill.
2. Ask Your Cloud Provider Detailed Security Questions
Do not assume that because a vendor is well-known, their security posture matches your requirements. Security capabilities, certifications, and contractual commitments vary significantly between providers — and even between service tiers within a single provider.
Key questions to ask include:
- Which compliance certifications do you hold (SOC 2, ISO 27001, FedRAMP, PCI DSS, HIPAA BAA, etc.)?
- How is data encrypted at rest and in transit, and who controls the encryption keys?
- What is your incident response and breach notification process?
- How do you handle data residency and geographic restrictions?
- What logging and audit trail capabilities are available, and how long are logs retained?
- What penetration testing have you conducted, and can you share the results or attestation?
The answers should directly inform which vendor you choose for which workload. A vendor that meets your needs for a development environment may not satisfy compliance requirements for production systems that handle personally identifiable information (PII) or payment card data.
3. Deploy an Identity and Access Management (IAM) Solution
Unauthorized access and account hijacking are consistently ranked among the top cloud security threats. Both are directly mitigated by a strong identity and access management (IAM) strategy.
A robust IAM implementation should include:
- Role-based access control (RBAC): Grant users and services only the permissions they need for their specific function — the principle of least privilege.
- Multi-factor authentication (MFA): Require a second factor for all accounts, especially privileged and administrative ones. MFA significantly reduces the impact of stolen credentials.
- Centralized policy enforcement: Define access policies once and enforce them consistently across cloud environments and on-premises systems.
- Service account management: Audit and rotate credentials for automated processes; avoid long-lived static credentials where short-lived tokens are supported.
- Single sign-on (SSO) integration: Reducing the number of separate credentials end users manage lowers both friction and risk.
Where possible, choose an IAM solution that spans both your on-premises and cloud environments. Unified identity management simplifies governance and reduces the risk of orphaned or misconfigured accounts.
4. Train Your Staff
Technology controls alone are insufficient. Human error and social engineering remain leading vectors for cloud breaches. Effective security training must reach all staff — not just the security team.
Training should cover:
- Phishing and spear-phishing awareness: Attackers regularly use targeted email campaigns to harvest cloud service credentials. Employees need to recognize warning signs and know how to report suspicious messages.
- Password hygiene: Strong, unique passwords combined with MFA are a basic but critical defense.
- Shadow IT risks: It is easy for employees to spin up cloud services — Dropbox, a personal AWS account, a SaaS tool — without IT knowledge. Explain why this creates unmanaged risk and what the approved alternatives are.
- Data handling policies: Employees need to understand which types of data can be stored in the cloud, and which cannot.
Security teams also need continuous professional development. The threat landscape evolves rapidly, and defenders must keep pace with new attack techniques, tooling, and countermeasures.
5. Establish and Enforce Cloud Security Policies
Security policies turn intent into repeatable, auditable behavior. Written policies should define:
- Which cloud services are approved for use, and for which data classifications.
- Who can provision new cloud resources and under what approval process.
- Required security controls for each environment tier (development, staging, production).
- Acceptable use guidelines for cloud storage, compute, and networking services.
- Procedures for offboarding employees with cloud access.
Policies are only effective when enforcement is automated. Use your cloud provider’s native policy tools — such as AWS Service Control Policies (SCPs), Azure Policy, or Google Cloud Organization Policies — to prevent non-compliant configurations from being deployed in the first place. Supplement these with third-party Cloud Security Posture Management (CSPM) tools where more granular or cross-cloud control is needed.
6. Secure Your Endpoints
Moving workloads to the cloud does not reduce endpoint risk — it often increases it, because more devices in more locations are now accessing cloud-hosted applications and data.
A strong endpoint security posture for cloud environments includes:
- Up-to-date endpoint detection and response (EDR) software on all managed devices.
- Device health checks before granting access to cloud resources (zero-trust device posture verification).
- Enforced disk encryption on laptops and mobile devices that access cloud services.
- Network controls — firewalls, DNS filtering, VPN or zero-trust network access (ZTNA) — for remote workers connecting to cloud applications.
- Regular patching schedules for operating systems and applications on all endpoints.
A cloud migration project is a good trigger to audit your existing endpoint security posture and close any gaps before they become cloud-era attack vectors.
7. Encrypt Data in Motion and at Rest
Encryption is a foundational cloud security control. It ensures that even if data is intercepted or storage media is compromised, the contents remain unreadable without the correct key.
- Data at rest: Encrypt all data stored in cloud object storage, databases, and block volumes. Most major providers offer server-side encryption by default; verify it is enabled and review key management options.
- Data in transit: Enforce TLS 1.2 or higher for all data moving between clients, services, and cloud environments. Disable older, insecure protocol versions.
- Key management: Use a dedicated key management service (KMS) — either your provider’s native offering or a third-party hardware security module (HSM)-backed solution — to control who can access encryption keys. Rotate keys regularly.
Where possible, implement encryption transparently so that end users and applications do not need to take manual steps to comply. Friction in the encryption process tends to produce workarounds.
8. Use Intrusion Detection and Prevention Technology
Intrusion detection systems (IDS) and intrusion prevention systems (IPS) monitor network traffic and system activity for signs of malicious behavior. In a cloud context, this capability is especially important because the attack surface is dynamic — new resources spin up and down continuously.
Modern cloud-native options include:
- Provider-native threat detection services (e.g., AWS GuardDuty, Microsoft Defender for Cloud, Google Security Command Center) that analyze logs, network flows, and API calls for anomalous behavior.
- Network-level IDS/IPS appliances deployed in your cloud VPC or virtual network for deeper packet inspection where needed.
- SIEM (Security Information and Event Management) platforms that aggregate and correlate logs from cloud services, endpoints, and on-premises systems to surface threats that span environments.
Prioritize solutions that work across both your cloud and on-premises environments to give your security team a unified view of your threat landscape.
9. Double-Check Your Compliance Requirements
Regulated industries — healthcare, financial services, retail, government — face specific legal and contractual requirements for how data is stored, processed, and protected. Geographic location adds another layer: data residency laws in the EU (GDPR), certain US states, and many other jurisdictions impose strict rules about where data can reside and who can access it.
Before migrating any workload to the cloud:
- Inventory the compliance frameworks that apply to your organization (HIPAA, PCI DSS, SOC 2, GDPR, FedRAMP, CMMC, etc.).
- Confirm that your chosen cloud provider holds the relevant certifications and can provide the necessary contractual documentation (e.g., HIPAA Business Associate Agreements).
- Verify that data residency and data sovereignty requirements can be met by the provider’s available regions.
- Understand which compliance obligations remain your responsibility versus the provider’s.
Compliance requirements should be evaluated workload by workload — a provider that is suitable for one application may not be for another.
10. Consider a Third-Party Security Partner
Cloud security is a specialized discipline. If your internal team lacks cloud security expertise, or if your existing security tooling does not extend to cloud environments, engaging a third-party partner may be the most practical path to reducing risk quickly.
Options include:
- Cloud Access Security Brokers (CASBs): Software that sits between your users and cloud service providers to enforce security policies, provide visibility into shadow IT, and prevent unauthorized data exfiltration. CASBs are particularly valuable for organizations using many different SaaS applications from multiple vendors.
- Managed Security Service Providers (MSSPs): Vendors that provide ongoing monitoring, threat detection, and incident response as a managed service — useful for teams without 24/7 security operations capacity.
- Cloud Security Posture Management (CSPM) tools: Continuously assess cloud configurations against security benchmarks and flag misconfigurations before they lead to incidents.
- Security consulting firms: Engagements focused on architecture review, threat modeling, and building a cloud security roadmap.
When evaluating third-party solutions, prioritize those with native integrations for the cloud platforms you use and the ability to correlate findings across your entire environment.
11. Conduct Audits and Penetration Testing
You cannot defend what you do not understand. Regular audits and penetration testing validate whether your security controls are actually working as intended.
- Penetration testing: Simulate real-world attacks against your cloud environment to identify exploitable vulnerabilities. Most major cloud providers have policies governing penetration testing by customers — review these before engaging a testing firm. Focus on your IAM configuration, network segmentation, publicly exposed services, and application logic.
- Configuration audits: Regularly scan cloud configurations against frameworks such as the CIS Cloud Benchmarks or your provider’s security best practices. Automated CSPM tools can make this continuous rather than point-in-time.
- SLA and vendor audits: Periodically verify that your cloud vendors are meeting the security commitments documented in your service level agreements. Request updated compliance attestations (SOC 2 Type II reports, for example) annually.
- Access log reviews: Insider threats — whether malicious or accidental — are a genuine risk. Regularly audit access logs to confirm that only authorized personnel are accessing sensitive cloud resources. Automated alerting on anomalous access patterns reduces the manual burden.
Treat audit findings and pen test results as a backlog of security debt to be prioritized and remediated on a defined schedule, not a one-time exercise.
Summary
Cloud security is a shared, ongoing responsibility — not a checkbox you tick at deployment time. The eleven practices above address the most common failure modes: unclear ownership of security controls, weak identity management, untrained staff, insufficient encryption, and gaps between policy and enforcement. Implementing them systematically gives your organization a strong foundation for operating securely in the public cloud, regardless of which provider or service model you choose.
Original research referenced in this article was sourced from a CloudPassage 2016 Cloud Security report and Gartner analyst commentary, as cited by esecurityplanet.com.