Skip to content

Cloud service in use

What has been found

Cloud service in use.

Cloud services are in use. Major cloud service providers (CSPs) maintain extensive, well-funded, and continuously evolving security programmes that typically exceed the capability of on-premises or self-managed environments. Their infrastructure benefits from global redundancy, advanced threat detection, automated patching, and compliance with rigorous international security standards.

Why this strengthens security

Leveraging cloud infrastructure enhances organisational security and resilience when properly configured. Cloud providers employ large-scale security operations, vulnerability management, and data protection frameworks that reduce many traditional infrastructure risks. Under the shared responsibility model, the CSP secures the physical and foundational infrastructure, while the customer manages configuration and access — together forming a robust, layered defence model.

When cloud services are implemented with appropriate governance and monitoring, they reduce exposure to ransomware, unauthorised access, and availability risks while improving scalability, continuity, and compliance alignment.

Why this is a potential risk

While CSPs invest heavily in security, the responsibility for secure configuration and usage lies with the customer under the shared responsibility model. Misconfigured or overly exposed cloud services are one of the most common causes of data breaches.

Key risks include:

  • Misconfiguration: Publicly accessible storage buckets, weak IAM policies, or exposed management interfaces can lead to data leakage or unauthorized access.

  • Overprivileged access: Inadequate identity and access management (IAM) controls may allow attackers to escalate privileges or move laterally within the cloud environment.

  • Shadow IT: Unmonitored or unsanctioned use of cloud services can bypass corporate security controls, leaving sensitive data unprotected.

  • Compliance impact: Exposure of regulated data (PII, financial, health records) via cloud services can trigger legal, regulatory, and reputational consequences.

  • Attack surface expansion: Exposed endpoints, APIs, or cloud-native services may be targeted for exploitation, ransomware deployment, or data exfiltration.

Cloud services can be secure, but improper configuration or governance turns them into high-value targets for attackers.

Potential improvements

Security Hardening

  • Apply the principle of least privilege to all accounts, roles, and API keys.

  • Enable multi-factor authentication (MFA) for administrative and high-sensitivity access.

  • Encrypt sensitive data at rest and in transit using CSP-approved mechanisms.

  • Regularly apply security patches to cloud-hosted VMs, containers, and applications.

Monitoring & Detection

  • Enable cloud-native monitoring and logging (e.g., AWS CloudTrail, Azure Monitor, GCP Cloud Audit Logs).

  • Integrate logs into a centralized SIEM for anomaly detection.

  • Continuously monitor for misconfigurations using CSP tools (e.g., AWS Config, Azure Security Center) or third-party CSPM (Cloud Security Posture Management) platforms.

How to verify ongoing effectiveness:

  • Perform external vulnerability scans to ensure no unintended public exposure.

  • Review firewall, security group, and IAM settings against baseline configurations.

  • Validate MFA, strong authentication, and encryption enforcement.

  • Run periodic cloud configuration audits (e.g., against NIST 800-53, CIS Benchmarks, or NCSC guidance).

  • Regularly review logs for unauthorised access attempts or anomalous behavior.

External references