Securing your IaaS Cloud

Cloud services have become a core enabler of digital transformation, with the events of 2020 accelerating shifts such as retail moving online, manufacturers reorganizing operations, and widespread remote work. As cloud usage becomes business-critical, security and compliance become central concerns, especially in hybrid IT environments where consistent governance across delivery models is essential. The report emphasizes that security and compliance responsibilities are shared: cloud service providers (CSPs) secure the underlying infrastructure, while cloud clients (tenants) are responsible for securing how services are configured and used, and for meeting legal and regulatory obligations. Many reported cloud security incidents stem from tenant misconfigurations and failures to apply established internal controls to cloud environments.

Key business risks include loss of business continuity from outages, cyber-attacks (including ransomware and denial of service), data breaches from leakage or unauthorized access, and regulatory compliance failures under frameworks such as GDPR, CCPA, PCI-DSS, and others. Mitigation requires governance that sets measurable objectives, verifies provider assurances, and integrates cloud controls into enterprise processes. Foundational practices include strong identity and access governance for privileged administrators, least-privilege access with segregation of duties, regular entitlement reviews, strong authentication, logging, and anomaly detection.

Data protection must cover encryption in transit (TLS 1.2/1.3 or IPsec), encryption at rest with tenant-controlled keys, and—where required—confidential computing approaches such as trusted execution environments, pseudonymization, or homomorphic encryption. Tenants must also implement backup and restore plans for resilience. Security hygiene further depends on automated vulnerability scanning, secure configuration templates, remediation of misconfigurations (including preventing public access to sensitive storage), and zero-trust network segmentation with private subnets and web application firewalls. The report highlights AWS examples (e.g., Control Tower, S3 public access controls, Artifact, Audit Manager, Outposts, GuardDuty, Detective) and stresses “trust but verify” through independent compliance evidence (ISO, SOC, CSA STAR, and related standards).

• The events of 2020 accelerated digital transformation by several years in a matter of months.
• Major cloud security incidents are frequently caused by tenant errors and misconfigurations.
• In basic IaaS, the CSP secures the infrastructure up to the hypervisor, while the tenant secures everything above it.
• For Amazon EC2, tenants manage the guest operating system, patches, installed software, and security group configuration.
• For Amazon S3, AWS runs the infrastructure layer while customers are responsible for securing and governing their data and permissions.
• Data can be exposed if storage media is lost, discarded, or reallocated without erasure.
• Data confidentiality can be threatened during processing because tools can extract information from processor memory or machine snapshots.
• The European Data Protection Board recommended additional technical measures for GDPR compliance when EU personal data is transferred outside the EU.
• AWS Artifact provides on-demand access to third-party audit reports such as SOC and PCI reports.
• The 2021 KuppingerCole Market Compass ranked AWS as an outstanding vendor for the range of tenant security capabilities provided.

• “The cloud has now become an integral part of business-critical operations where security and compliance are essential considerations.”
• “Most of the reported cloud related cyber incidents have been due to errors by the cloud client (or in other words cloud tenant).”
• “Your cloud administrative access rights are a prime target of cyber adversaries - make sure that you protect them.”
• “Access rights should be based on the principle of least privilege with enforced segregation of duties.”
• “Your business-critical data could be at risk from cyber-attacks, ransomware, and misuse as well as system failures. Make sure that you protect it.”
• “Most cyber-attacks exploit well known technical vulnerabilities - implement automated processes to identify and remove common vulnerabilities.”
• “The network provides a route for cyber adversaries to attack your systems - take a zero-trust approach to network security.”
• “Adapt your existing service and security management processes to include your use of cloud services.”
• “Make sure that the cloud is independently verified and use the capabilities provided to ensure that you use the service in a way that complies with your obligations.”
• “Trust but verify.”