Cloud Security Fundamentals

The provider handles parts of the stack, but you still own how your environment is configured and who can access it. In practice, that means identity, permissions, logging, and data controls are your responsibility.

• Identity: who can sign in, from where, and with what privileges.
• Configuration: storage permissions, network exposure, and security policies.
• Data: classification, sharing, and retention.

• MFA for all users and especially administrators.
• Conditional access to reduce risky sign-ins and unmanaged device access.
• RBAC and least privilege with periodic access reviews.
• Identity foundations so access scales cleanly as you grow.

If you fix nothing else, fix identity. Identity is the perimeter in the cloud.

• Use baseline policies and secure defaults for storage, networking, and admin tooling.
• Track configuration changes and alert on risky states (public access, excessive permissions).
• Limit “break glass” patterns and make exceptions visible and time-bound.

Cloud security improves when configuration is treated like code and monitored like production systems.

If you cannot answer “who did what, when” you cannot investigate or prove control operation.

• Centralize key events into a SIEM approach where feasible.
• Ensure admin actions and sign-ins are captured and retained.
• Alert on risky identity changes (new privileged roles, MFA method changes, suspicious sign-ins).

• Define what “restore” means for your core systems and data.
• Test restores on a schedule and keep evidence (Backup & DR testing).
• Practice incident coordination via tabletop exercises.

If ransomware or destructive access hits the cloud tenant, you need a practiced path to recover.