Is the cloud less secure than on-premise hosting?

Not inherently. Major cloud providers offer a level of infrastructure security that few companies can match on-premise. The risk shifts to configuration and access management, which are the customer’s responsibility. A well-configured cloud is generally more secure than a poorly maintained internal data centre.

What is the shared responsibility model?

It is the principle whereby security is shared between the cloud provider (infrastructure security) and the customer (security of configurations, access and data). The exact split depends on the service model (IaaS, PaaS, SaaS), but the customer always remains responsible for their data and access.

What is a CSPM and do I need one?

A CSPM (Cloud Security Posture Management) is a tool that continuously analyses your cloud environments to detect misconfigurations and non-compliance. As soon as you manage several cloud accounts or services, it becomes very useful to avoid accidental exposures, the leading cause of cloud incidents.

Do you secure AWS, Azure and GCP?

Yes. We provide audits and support across the three main providers (AWS, Azure, GCP), against the CIS Benchmarks and each platform’s best practices, as well as for containers and Kubernetes.

Is cloud security required for ISO 27001 or SOC 2?

Yes. If your business runs on the cloud, the security of these environments is central to your risk analysis and to the controls expected by both ISO 27001 and SOC 2. A cloud configuration audit directly feeds these initiatives.

Cloud Security: AWS, Azure & GCP security for SaaS and fintech

What is Cloud Security?

Cloud security refers to the set of technical and organisational measures that protect resources hosted with a public cloud provider (Amazon Web Services, Microsoft Azure, Google Cloud Platform). It covers service configuration, access management, encryption, monitoring and compliance.

Contrary to a common belief, moving to the cloud does not remove your security obligations: it redistributes them. That is the whole point of the shared responsibility model.

The shared responsibility model

The shared responsibility model is the founding concept of cloud security: it defines who, between the provider and the customer, secures what. Moving to the cloud does not make your security obligations disappear, it redistributes them. The provider takes care of "security OF the cloud" — data centres, hardware, physical network and hypervisor — while the customer remains responsible for "security IN the cloud": service configuration, identity and access management, encryption and application security. The cursor of this split shifts with the service model: very broad on the customer side in IaaS, smaller in SaaS, but the customer always remains responsible for their data and access. Understanding this boundary is essential, because the vast majority of cloud incidents come from the customer side — a misconfiguration — and not from a provider flaw.

The provider is responsible for "security OF the cloud": data centres, hardware, physical network, hypervisor.
The customer is responsible for "security IN the cloud": service configuration, identity and access management, data encryption, application security.
Most cloud incidents come from the customer side (misconfiguration), not the provider.

The main cloud risks

Contrary to a widespread intuition, cloud incidents rarely stem from a provider flaw: they almost always come from the way the customer configures and operates their environments. The cloud shifts the attack surface rather than removing it, and its very flexibility — spinning up resources in a few clicks, multiplying accounts and services — multiplies the opportunities for error. A resource exposed by mistake remains reachable at internet scale, turning a simple oversight into a data leak. The most frequent risks revolve around four families: misconfigurations, access management, exposure of application interfaces and lack of visibility. Identifying these risks is the prerequisite to any effective security strategy. Here are the main points of vigilance:

Misconfigurations: publicly exposed storage (S3 buckets, Azure blobs), open ports, services accessible without authentication.
Poor access management: overly broad IAM permissions, API keys exposed in code, no MFA on privileged accounts.
Exposure of poorly protected APIs and serverless functions.
Container and Kubernetes security (vulnerable images, plaintext secrets, exposed API).
Lack of logging and monitoring, preventing intrusion detection.
Non-compliance and poor data localisation (GDPR, health data).

Cloud security best practices

Securing a cloud environment is not about stacking up tools, but about methodically applying a few structuring principles, aligned with the CIS Benchmarks and each provider's own recommendations. The guiding logic is least privilege: every identity, service or resource should hold only the permissions strictly necessary, and nothing more. To this are added reducing the exposed surface, systematic data encryption, and above all visibility — without centralised logging and monitoring, an intrusion can go unnoticed for weeks. Finally, because cloud environments change constantly, security must be verified continuously rather than audited once a year: that is the role of a CSPM, which automatically detects configuration drift. Here are the essential practices to implement:

Apply least privilege on IAM and enable MFA everywhere, especially on privileged accounts.
Encrypt data at rest and in transit, and manage keys properly.
Deploy a CSPM (Cloud Security Posture Management) to continuously detect misconfigurations.
Segment networks and restrict public exposure to the strict minimum.
Centralise logging (CloudTrail, Azure Monitor, Cloud Logging) and monitor abnormal behaviour.
Secure the CI/CD pipeline and containers (image scanning, secrets management).
Regularly audit configuration against the CIS Benchmarks.

Cloud Security for SaaS and fintech

SaaS vendors and fintechs are cloud-native and handle sensitive client data. Their cloud security is scrutinised by enterprise clients, investors and regulators.

Beyond technical best practices, the challenge is often to prove that security: data isolation between clients (multi-tenant), ISO 27001 or SOC 2 compliance, and answering security questionnaires. We help both to secure and to demonstrate.

My Cloud Security support

NagaShield performs cloud configuration audits (AWS, Azure, GCP) against the CIS Benchmarks, identifies critical exposures and supports remediation. As an outsourced CISO, I integrate cloud security into your overall governance and compliance journey (ISO 27001, NIS2).

Cloud Security: securing AWS, Azure and GCP