Cloud services have become a core component of modern organizational IT environments. They provide flexibility, scalability, and operational efficiency, but at the same time introduce new cybersecurity challenges. Sensitive organizational data is often stored in cloud environments, making properly configured security controls essential to ensure the resilience of networks and information systems.
This article outlines the fundamental principles of cloud service delivery, highlights key threats and risks, and presents recommended technical and organizational controls to strengthen cloud security.
Why cloud security matters
According to the ENISA Threat Landscape 2024, cloud adoption remains consistently high, with organizations using, on average, more than two cloud service providers simultaneously. Furthermore, over 47% of data stored in cloud environments is considered sensitive, significantly increasing the potential impact of security incidents.
Threat actors increasingly abuse legitimate cloud platforms and trusted services to evade detection. This technique, known as Living Off Trusted Sites (LOTS), complicates threat identification and enables malicious activity to blend into normal cloud traffic. As a result, cloud environments have become a primary target for cyberattacks.
In parallel, national and European regulatory frameworks, including the Cyber Security Law transposing the NIS2 Directive, require organizations to ensure appropriate cybersecurity controls across their entire IT environment, including cloud services, with a strong focus on risk management, incident handling, and supply chain security.
Cloud service models and shared responsibility
Cloud services are delivered through different models, each defining a distinct division of responsibility:
- Infrastructure as a Service (IaaS) – the provider secures the physical infrastructure, while the organization is responsible for operating systems, applications, configurations, and data security.
- Platform as a Service (PaaS) – the provider manages infrastructure, operating systems, and platforms, while the organization remains responsible for application and data security.
- Software as a Service (SaaS) – the provider handles the entire technical stack, and the organization focuses on access management and data protection.
The level of organizational responsibility increases with the degree of control over the environment.
Key cloud security threats
Improperly configured or insufficiently monitored cloud environments may expose organizations to:
- ● inadequate access control and account compromise;
- ● data leakage caused by misconfigured sharing permissions;
- ● ransomware attacks affecting synchronized and shared cloud data;
- ● social engineering and phishing attacks via email and collaboration tools;
- ● configuration errors and unauthorized third-party integrations;
- ● supply chain vulnerabilities through APIs and external add-ons.
Recommended security controls
To mitigate these risks, organizations should implement the following measures:
- Strong access control and multi-factor authentication, following the principle of least privilege and Zero Trust;
- Data classification and Data Loss Prevention (DLP) policies to restrict unauthorized sharing;
- Email security controls, including SPF, DKIM, DMARC, and anti-phishing mechanisms;
- Continuous monitoring and logging, integrating cloud logs with SIEM and CASB solutions;
- Mobile device management, using MDM or EMM platforms;
- Independent and immutable backups, stored separately from production environments;
- Incident response and business continuity planning, regularly tested and updated.
Data localization and compliance
The geographical location of cloud-stored data is a critical factor for legal compliance, privacy, and security. Organizations should clearly define data residency requirements in contracts and prioritize storage within the European Economic Area to meet GDPR and NIS2 obligations, while ensuring auditability and traceability.
Continuous oversight and security awareness
Effective cloud security requires ongoing oversight, including configuration management, periodic access reviews, log analysis, backup testing, and regular employee training. A strong security culture and consistent security hygiene are essential to maintaining confidentiality, integrity, and availability of cloud-based information assets.
Have more questions or want to know more about security threats of hosting in cloud? Let's talk!