The cloud doesn't make you secure by default
A common misconception: moving to a major cloud provider (Microsoft Azure, Amazon Web Services, Google Cloud) means security is handled. This is dangerously incomplete. Every major cloud provider operates under a Shared Responsibility Model — the provider secures the underlying infrastructure, but your organisation remains fully responsible for securing what you build and configure on top of it.
The Shared Responsibility Model
| Responsibility | Cloud Provider | Customer |
|---|---|---|
| Physical infrastructure | ✓ | — |
| Network infrastructure | ✓ | — |
| Hypervisor & host OS | ✓ | — |
| Guest OS & patching | — | ✓ |
| Identity & access management | — | ✓ |
| Data encryption | — | ✓ |
The lines shift depending on whether you use IaaS, PaaS, or SaaS — the more managed the service, the more the provider takes on. But identity, data, and configuration choices almost always stay yours to secure.
Identity is the new perimeter
In cloud environments, the traditional network perimeter has effectively dissolved. Identity becomes the actual security boundary. This means:
- Every user and service should be verified based on identity, not network location alone
- Multi-Factor Authentication (MFA) is non-negotiable for privileged accounts specifically, not just optional hardening
- Privileged Identity Management (in Azure) or equivalent just-in-time elevated access models minimise standing access
Key controls for cloud security
1. Secure the control plane
Your cloud management console is the keys to everything. Apply MFA universally, minimise standing (always-on) privileged access, use Conditional Access policies where available, and apply least-privilege role definitions consistently.
2. Enable logging and monitoring
Azure: Defender for Cloud + Log Analytics. AWS: CloudTrail + GuardDuty + Security Hub. GCP: Cloud Audit Logs + Security Command Center. Without logs, you cannot investigate, respond to, or even reliably detect an incident after the fact.
3. Encrypt everything
Enable encryption at rest and in transit for all sensitive data. Use customer-managed keys (Azure Key Vault, AWS KMS, Google Cloud KMS) rather than provider-default keys where genuine control over key rotation and access matters.
4. Network segmentation
Use Virtual Networks (Azure/VPCs) segmented appropriately. Apply Network Security Groups or Security Groups to restrict lateral movement. Private endpoints keep traffic off the public internet where a service supports them.
5. Vulnerability management
Continuously scan cloud workloads for vulnerabilities. Azure: Defender for Servers. AWS: Inspector. GCP: Container Analysis.
The CSSP and AZ-500 certifications
For professionals working with cloud environments, real credentials matter. CCSP (Certified Cloud Security Professional) — ISC2's vendor-neutral cloud security certification, covering architecture, governance, and compliance. AZ-500 (Microsoft Azure Security Technologies) — Microsoft's vendor-specific credential for Azure security engineers.
How RETIS supports cloud security
RETIS Systems provides cloud security configuration review, managed security advisory, and DevSecOps integration for organisations operating on Azure, AWS, and GCP — with certified engineers holding the specific credentials the underlying cloud platform actually requires.