Cloud Security: securing AWS, Azure and GCP

What is Cloud Security?

Cloud security refers to the set of technical and organisational measures that protect resources hosted with a public cloud provider (Amazon Web Services, Microsoft Azure, Google Cloud Platform). It covers service configuration, access management, encryption, monitoring and compliance.

Contrary to a common belief, moving to the cloud does not remove your security obligations: it redistributes them. That is the whole point of the shared responsibility model.

The shared responsibility model

This is the founding concept of cloud security. The split of responsibilities varies by service type (IaaS, PaaS, SaaS), but the principle is constant:

• The provider is responsible for "security OF the cloud": data centres, hardware, physical network, hypervisor.
• The customer is responsible for "security IN the cloud": service configuration, identity and access management, data encryption, application security.
• Most cloud incidents come from the customer side (misconfiguration), not the provider.

The main cloud risks

• Misconfigurations: publicly exposed storage (S3 buckets, Azure blobs), open ports, services accessible without authentication.
• Poor access management: overly broad IAM permissions, API keys exposed in code, no MFA on privileged accounts.
• Exposure of poorly protected APIs and serverless functions.
• Container and Kubernetes security (vulnerable images, plaintext secrets, exposed API).
• Lack of logging and monitoring, preventing intrusion detection.
• Non-compliance and poor data localisation (GDPR, health data).

Cloud security best practices

Securing a cloud environment rests on a few structuring principles, aligned with CIS frameworks and provider recommendations:

• Apply least privilege on IAM and enable MFA everywhere, especially on privileged accounts.
• Encrypt data at rest and in transit, and manage keys properly.
• Deploy a CSPM (Cloud Security Posture Management) to continuously detect misconfigurations.
• Segment networks and restrict public exposure to the strict minimum.
• Centralise logging (CloudTrail, Azure Monitor, Cloud Logging) and monitor abnormal behaviour.
• Secure the CI/CD pipeline and containers (image scanning, secrets management).
• Regularly audit configuration against the CIS Benchmarks.

Cloud Security for SaaS and fintech

SaaS vendors and fintechs are cloud-native and handle sensitive client data. Their cloud security is scrutinised by enterprise clients, investors and regulators.

Beyond technical best practices, the challenge is often to prove that security: data isolation between clients (multi-tenant), ISO 27001 or SOC 2 compliance, and answering security questionnaires. We help both to secure and to demonstrate.

My Cloud Security support

NagaShield performs cloud configuration audits (AWS, Azure, GCP) against the CIS Benchmarks, identifies critical exposures and supports remediation. As an outsourced CISO, I integrate cloud security into your overall governance and compliance journey (ISO 27001, NIS2).