Shared responsibility, identity, data protection, secure configuration and logging: practical cloud security measures based on NSA, CISA and CSA guidance.
Securing the cloud starts with a clear understanding of the shared responsibility model: the provider secures the underlying infrastructure, while the customer remains responsible for identities, configurations, data and the workloads it deploys. Many cloud incidents stem from weaknesses on the customer side, such as excessive permissions, exposed storage, leaked keys or missing logs. The practices below, drawn from guidance by NSA, CISA and the Cloud Security Alliance, address these weaknesses in a structured way.
The split of responsibilities differs between infrastructure (IaaS), platform (PaaS) and software as a service (SaaS). With IaaS, the customer manages operating systems, network rules and applications; with SaaS, the customer mostly manages identities, data and configuration settings. In every model, the customer keeps responsibility for who can access what and for the protection of its data.
In March 2024, NSA published ten cloud security mitigation strategies, six of them together with CISA, and the first one is precisely to uphold the shared responsibility model. In practice, governance means:
The Cloud Security Alliance Cloud Controls Matrix (CCM), whose version 4.1 was released in January 2026 across 17 control domains, and ISO/IEC 27017 for cloud-specific controls, can serve as reference frameworks for these requirements.
In the cloud, a stolen credential often gives direct access to resources, without any network barrier. Identity and access management therefore deserves the highest priority:
Data protection combines classification, encryption and access control. Encryption at rest and in transit is widely available by default, but the key management choice matters: provider-managed keys are simple, while customer-managed keys in a key management service or hardware security module give more control over rotation, access and revocation. Key administration should be separated from data administration.
Storage exposure remains a classic problem. Block public access at the organization level where the platform allows it, and use automated checks to detect storage buckets, snapshots or databases that become publicly reachable.
Misconfiguration is a leading cause of cloud exposure. Define secure baselines, for example from CIS Benchmarks or provider security baselines, and monitor drift continuously with cloud security posture management tools. Segment networks into distinct virtual networks or subnets, restrict management ports, and prefer private endpoints for access to platform services.
Infrastructure as code helps enforce consistency: templates are reviewed like application code, scanned for insecure settings before deployment, and applied through pipelines rather than manual changes. The pipelines themselves must be protected, since compromised CI/CD tooling can deploy malicious changes with legitimate permissions. Secrets should live in a dedicated vault, never in code repositories.
Cloud platforms generate rich audit logs, but some of them must be explicitly enabled or retained longer than the default. At a minimum, collect control plane activity, identity events, network flow logs for sensitive segments, and logs from critical services, and send them to a central platform protected against deletion. Define detection rules for high-risk actions such as disabling logging, creating access keys for privileged users, or changing network exposure.
Incident response plans must include cloud-specific procedures: how to revoke sessions and keys, how to isolate a workload, how to take snapshots for investigation, and how to reach the provider's support. Test these procedures, because cloud environments change faster than traditional infrastructure.
Many organizations combine on-premises systems with several providers. Each platform has its own identity model, logging format and security services, which multiplies the risk of inconsistent controls. Use a common set of policies and a central view of posture and logs, and make sure that network links between on-premises and cloud environments do not bypass the controls applied elsewhere.
Cloud security requires both architectural knowledge and hands-on skills on specific platforms. The CCSK v5 course covers vendor-neutral cloud security principles based on Cloud Security Alliance guidance, and ISC2 CCSP certification preparation addresses cloud security architecture and governance in more depth. For practical engineering across providers, EC-Council's Certified Cloud Security Engineer (C|CSE) is available at Securevalley Training as an EC-Council Authorized Reseller.
Cloud security is mostly a customer responsibility exercised through identity, configuration, data protection and monitoring. Organizations that apply clear governance, least privilege, automated guardrails and centralized logging reduce most common risks. Established references such as NSA and CISA guidance and the CSA Cloud Controls Matrix provide a practical framework to prioritize these efforts.