🛡️ Cloud Security

Cloud Security Best Practices are a set of principles and controls used to protect cloud-hosted applications, data, identities, and infrastructure from cyber threats. Modern cloud security is built around the concepts of Zero Trust, least privilege, continuous monitoring, and defence in depth.

According to NIST, organisations should focus on understanding cloud security responsibilities, managing risk, and implementing controls that protect data, applications, and infrastructure.

NIST - Cloud Security | NIST Guidelines on Security and Privacy

Microsoft’s Well-Architected Framework highlights identity protection, infrastructure security, data protection, governance, and incident response as key security areas.

Microsoft’s Well-Architected Framework - Security overview | Security design principles

1. Adopt a Zero Trust Security Model

Never automatically trust any user, device, or service. In other words, never assume that a user, device, or workload is trustworthy simply because it is inside your network.

Best practices:

Verify explicitly every access request.
Enforce least-privilege permissions.
Continuously validate identity and device health.
Assume breach and limit the impact of a compromise.
Segment applications and services to limit lateral movement.

This approach reduces the likelihood of attackers moving freely inside your environment.

Example:

A developer should only have access to development resources, not production databases.

2. Strengthen Identity and Access Management (IAM)

Identity is the new security perimeter in cloud environments.

Best practices:

Enable Multi-Factor Authentication (MFA) for all users.
Enforce strong password policies.
Use Role-Based Access Control (RBAC).
Apply the principle of least privilege.
Grant only the permissions users actually need.
Regularly review and remove unused accounts and permissions.
Use Privileged Identity Management (PIM) for administrative accounts.

Microsoft identifies identity and access management as the foundation of secure cloud computing.

Common mistake:

Granting users “Owner” or “Administrator” permissions when only read access is required.

3. Apply the Principle of Least Privilege

Users, applications, and services should have only the minimum permissions required.

Examples:

Developers should not have production administrator rights.
Applications should access only the databases they need.
Temporary elevation should be used for administrative tasks.

Benefits:

Reduces attack surface.
Limits damage from compromised accounts.

4. Protect / Encrypt Data Everywhere

Protect data both when it is stored and when it is transmitted.

Best practices:

Encrypt data at rest.
Encrypt data in transit using TLS.
Use customer-managed encryption keys when appropriate.
Rotate encryption keys regularly.

Areas to secure:

Databases
Object storage
Backups
Application secrets

Data must be protected:

At Rest

Encrypt stored data using strong encryption algorithms.

In Transit

Use:

HTTPS
TLS
VPNs
Private connectivity where appropriate

In Use

Protect sensitive processing environments and credentials.

Data encryption, classification, and retention policies are specifically recommended cloud security controls.

5. Secure Network Architecture

Even in the cloud, network security remains important.

Best practices:

Use private endpoints.
Restrict public exposure.
Implement Web Application Firewalls (WAF).
Use DDoS protection services.
Separate environments:
- Development
- Test
- Staging
- Production

Use multiple layers of network protection:

Firewalls
Network segmentation
Private subnets
DDoS protection
Web Application Firewalls (WAF)
Network Security Groups

A compromised system should not automatically gain access to the entire network.

Example architecture:

Internet
    |
    V
WAF
    |
Load Balancer
    |
Application Tier
    |
Private Database

6. Secure the CI/CD Pipeline

Modern attacks increasingly target build systems.

Best practices:

Sign application artefacts.
Scan dependencies.
Scan container images.
Protect build agents.
Restrict access to deployment pipelines.

For DevSecOps:

SAST (Static Application Security Testing)
DAST (Dynamic Application Security Testing)
Dependency scanning
Container scanning

7. Continuously Monitor and Log Activity

You cannot protect what you cannot see.

Best practices:

Enable centralised logging.
Collect security events.
Monitor access patterns.
Create alerts for suspicious activities.
Integrate logs into a SIEM platform.

Examples:

Microsoft Sentinel
Splunk
Elastic Security

Monitor:

Login attempts / Failed logins
API calls
Administrative actions
Configuration changes
Suspicious network traffic
Privilege escalation
Data exfiltration attempts

Maintain:

Centralized logging
Security alerts
Security Information and Event Management (SIEM)

Monitoring and logging are core security governance recommendations.

8. Implement Continuous Vulnerability Management

Keep Systems Updated. Cloud environments change constantly.

Best practices:

Scan containers regularly.
Patch operating systems promptly.
Patch application frameworks and libraries.
Maintain an accurate asset inventory.
Prioritise critical vulnerabilities.
Remove unsupported software

Do not rely solely on annual penetration tests.

Many breaches occur because known vulnerabilities remain unpatched.

9. Protect Secrets and Credentials

Hardcoded credentials remain one of the most common cloud security weaknesses.

Best practices:

Store secrets in:
- Azure Key Vault
- AWS Secrets Manager
- Google Secret Manager
Rotate secrets automatically.
Use Managed Identities whenever possible.
Avoid storing credentials in source control.

Never store secrets in:

Source code
Configuration files
Public repositories

Use:

Secret management services
Managed identities
Key vaults
Credential rotation policies

Bad:

string password = "SuperSecret123";

Better:

string password = await keyVault.GetSecretAsync("DatabasePassword");

10. Establish Backup and Disaster Recovery Plans

Backups are part of security.

Prepare for:

Ransomware attacks
Data corruption
Accidental deletion
Regional outages

Best practices:

Follow the 3-2-1 backup strategy.
Encrypt backups.
Store backups separately.
Automated backups
Geographic replication
Regular recovery testing - Test restoration procedures regularly
Defined Recovery Time Objectives (RTO)

Many organisations discover recovery issues only after a real incident.

11. Automate Security Compliance

Use Infrastructure as Code (IaC) Securely.

Security should be built into deployment pipelines.

Best practices:

Use Infrastructure as Code (IaC).
Scan infrastructure before deployment.
Enforce security policies automatically.
Prevent non-compliant resources from being created.

Tools:

Terraform
Bicep
AWS CloudFormation
Azure Policy

For cloud platforms such as Azure, AWS, and Google Cloud:

Store infrastructure definitions in source control.
Scan templates for security issues.
Review changes through pull requests.
Automate security checks in CI/CD pipelines.

12. Perform Regular Security Assessments

Conduct:

Vulnerability scanning
Penetration testing
Compliance audits
Security architecture reviews

Security should be treated as a continuous improvement process, not a one-time project.

13. Prepare an Incident Response Plan

Security incidents are not a matter of if, but when.

Best practices:

Create incident response playbooks.
Detection procedures
Communication plans
Define escalation paths.
Recovery steps
Practice tabletop exercises.
Automate containment where possible.
Maintain forensic logging.
Post-incident reviews

Example incidents:

Credential theft
Ransomware
Data breach
Misconfigured storage account

Organisations should regularly test and improve their incident response plans.

14. Understand the Shared Responsibility Model

One of the most important cloud security concepts is that security responsibilities are shared between the cloud provider and the customer. NIST highlights the importance of understanding these responsibilities when moving data and services to the cloud.

Typical responsibility:

Area	Cloud Provider	Customer
Physical Datacentres	✓
Hardware	✓
Operating Systems (PaaS)	✓
Applications		✓
User Accounts		✓
Data		✓
Permissions		✓

A Practical Cloud Security Checklist

✅ MFA enforced everywhere

✅ Implement Zero Trust

✅ Apply least-privilege access

✅ Encrypt data at rest and in transit

✅ Secure secrets and credentials (stored in a vault)

✅ Centralised logging and monitoring

✅ Automated compliance policies

✅ CI/CD security scanning

✅ Vulnerability management programme (Patch vulnerabilities quickly)

✅ Incident response plan tested

✅ Backups regularly restored and verified

✅ Network segmentation implemented

✅ Monitor and log continuously (Continuously assess and improve security)

✅ Shared responsibility clearly documented

These practices help maintain the three core security objectives: Confidentiality, Integrity, and Availability (CIA Triad), while reducing the risk and impact of security incidents.