Myth: moving to the cloud means security is handled for you.
Fact: the provider secures the platform. You secure everything you put on it.
The shared responsibility model
| Layer | Provider | You |
|---|---|---|
| Physical data centres | ✔ | |
| Hypervisor and hardware | ✔ | |
| Identity and access | ✔ | |
| Network configuration | ✔ | |
| Data and encryption keys | ✔ |
Most cloud incidents don’t come from the provider being breached. They come from a storage bucket left public, an over-privileged service account, or logging that was never switched on.
Three controls to start with
- Least-privilege access. Give every user and service only the permissions it needs, and review them quarterly.
- Logging you actually read. Turn on audit logs and route them somewhere a person or an alert will see them.
- Configuration baselines. Use policy tools to block risky settings before they reach production.
Security in the cloud is a configuration problem long before it is a technology problem.
