Cloud adoption has reached a point where virtually every organisation — regardless of size — relies on cloud infrastructure for at least part of its operations. Flexera’s 2020 State of the Cloud Report found that 93% of survey respondents reported their organisations had active multi-cloud strategies. With that scale of adoption comes an expanded attack surface, and security teams are under increasing pressure to close gaps before they are exploited.
This article breaks down the five most significant cloud security threats facing organisations today and explains what DevOps, platform, and security engineering teams can do to mitigate each one.
1. Weak or Poorly Managed Access Controls
One of the most common root causes of cloud security incidents is not a flaw in cloud technology itself — it is the way organisations grant and manage access to cloud resources. As cloud platforms lower the cost of storage and compute, teams move quickly and often skip the discipline of defining least-privilege access policies from the start.
What to do
- Apply the principle of least privilege. Users, service accounts, and automated pipelines should have access only to the specific resources they need to perform their function — nothing more. Audit permissions regularly and remove anything that is no longer required.
- Revoke access immediately on offboarding. A number of high-profile breaches have involved former employees who retained access to corporate cloud accounts long after leaving. Establish a formal, automated offboarding process that is triggered the moment an employee departure is confirmed, coordinated between HR and IT operations.
- Enforce multi-factor authentication (MFA). Most major cloud providers — AWS, Azure, and Google Cloud — offer MFA as a standard feature. Require it for all users, and especially for accounts with administrative privileges.
- Consider a separation of duties (SoD) model. For critical operations — such as deleting production data or modifying IAM policies — require approval or action from more than one authorised individual. This limits the blast radius if a privileged account is compromised.
2. Data Breaches and Data Leaks
Cloud environments involve large volumes of data flowing between users, applications, and services. That traffic presents opportunities for attackers to intercept sensitive information. The 2017 Equifax breach — in which the personal data of more than 148 million individuals was exposed — is a well-documented example. Attackers were able to exploit a vulnerability that went undetected for approximately 76 days, in part because of an expired digital certificate that prevented traffic inspection.
What to do
- Encrypt data in transit and at rest. Use TLS for all communications between services and clients. Ensure storage buckets, database instances, and block storage volumes are encrypted at rest using keys that your team controls or manages through a key management service (KMS).
- Manage your digital certificates proactively. Certificate expiry is a common operational failure. Use automated certificate management tools (such as AWS Certificate Manager, Let’s Encrypt with automated renewal, or cert-manager in Kubernetes) to avoid lapses.
- Use a VPN for remote access. Staff accessing cloud resources over untrusted networks — such as home broadband or public Wi-Fi — should route traffic through a VPN. Evaluate VPN providers carefully; free or low-cost services may log user activity or use weaker encryption schemes. Prefer solutions with audited no-log policies and AES-256 encryption.
- Secure email communications. Use S/MIME certificates or similar standards for signing and encrypting email, particularly for communications that involve sensitive operational or customer data.
3. Data Loss
Moving to the cloud does not eliminate the risk of data loss — it changes its shape. Ransomware attacks targeting cloud storage are an increasing concern: an attacker who gains sufficient access can encrypt or delete your data and demand payment for its return. Research has indicated that a significant proportion of organisations have publicly exposed cloud storage services, making them easy targets for automated scanning tools used by attackers.
What to do
- Implement a distributed backup strategy. Do not rely on a single cloud provider or a single region for backup. Follow the 3-2-1 rule: three copies of your data, on two different media types, with one copy stored off-site or in a separate cloud account or region.
- Test your restores regularly. A backup that has never been tested is not a backup. Schedule regular restoration drills to verify that backups are complete, uncorrupted, and can be recovered within your recovery time objective (RTO).
- Use object versioning and soft deletes. Cloud storage services such as S3 and Azure Blob Storage offer object versioning and soft-delete features. Enabling these provides a recovery path in the event of accidental deletion or ransomware encryption.
4. Insecure APIs
APIs are the primary interface through which applications and users interact with cloud services. They are also a significant attack vector. Poorly designed or misconfigured APIs can expose data, grant excessive permissions to third-party services, or allow attackers to enumerate resources within your environment. High-profile incidents have shown that even large platform providers have, at times, stored sensitive credentials insecurely or granted internal staff broader access than necessary.
What to do
- Vet cloud vendors against recognised security standards. The OWASP API Security Top 10 is a useful reference. When evaluating cloud providers or SaaS tools, ask how they address broken object-level authorisation, excessive data exposure, and lack of rate limiting.
- Audit third-party API access regularly. Review OAuth grants, API keys, and service account permissions for any third-party integrations. Revoke access that is no longer needed.
- Enforce API authentication and authorisation. Require authentication for all API endpoints. Use short-lived tokens rather than long-lived API keys where possible, and rotate credentials on a schedule.
- Use an API gateway. Placing an API gateway in front of your services allows you to enforce rate limiting, authentication, logging, and anomaly detection in a centralised location.
5. Cloud Misconfiguration
Misconfiguration is consistently identified as one of the leading causes of cloud security incidents. Default security settings on cloud services are often permissive, and teams working under pressure to ship quickly may not take the time to review them. Publicly accessible S3 buckets, overly permissive security groups, and unencrypted storage volumes are among the most common examples. The consequences can be severe: misconfigured cloud storage has exposed sensitive government documents, healthcare records, and financial data in widely reported incidents.
What to do
- Never rely on default settings. Review the default configuration of every cloud service you deploy and explicitly set access controls, encryption, and logging according to your security policy.
- Use infrastructure as code (IaC) with built-in policy checks. Tools such as Terraform, AWS CloudFormation, and Pulumi allow you to codify your infrastructure. Pair them with static analysis tools — such as Checkov, tfsec, or AWS Config rules — to catch misconfigurations before they reach production.
- Enable cloud security posture management (CSPM). CSPM tools (such as AWS Security Hub, Microsoft Defender for Cloud, or third-party solutions) continuously scan your cloud environment for misconfigured resources and alert your team to deviations from baseline policy.
- Conduct regular configuration audits. Complement automated tooling with periodic manual reviews, particularly after major infrastructure changes or the addition of new cloud services.
Building a Stronger Cloud Security Posture
None of the threats described above are novel, but they remain widespread precisely because they are easy to overlook under the pressure of delivery timelines. The good news is that the mitigations are well understood and largely available within the tooling your cloud provider already offers.
Effective cloud security is not a one-time project — it is an ongoing operational discipline. Regular audits of access controls, automated configuration checks, tested backup and recovery procedures, and careful vendor evaluation are the practical foundations of a resilient cloud environment. Building these habits into your engineering culture pays dividends well beyond any individual incident.
This article is adapted from a post originally published on BestDevOps.com, drawing on source material from SecurityBoulevard.com.