In addition to the security services that Cloud providers offer, your business should consider some further steps to bolster the protection of your Cloud assets:

• Understand what is being done in the Cloud. Know how your business is using the Cloud and what assets are on it. Knowing the extent to which you use the Cloud ensures you are making the right investments in security and taking suitable measures to prevent disruption to services.
• Be aware of the “Shared Responsibility” Model. Cloud providers operate a shared responsibility model which means they take responsibility for some security needs, but Cloud users must also protect their data against corruption and loss in the Cloud. Cloud users must know what their responsibilities are and how they can meet them.
• Understand how to protect Cloud assets. A different skillset is required to develop good Cloud security, requiring awareness of the differences between Cloud security and protection for local machines.
• Employ access controls. Strong authentication and authorisation technology should be employed to verify the identity of anyone attempting to access Cloud resources to ensure they have access privileges. Multi Factor Authentication and VPN are two ways to control access and monitor activity.
• Cloud security posture management solutions. These automate Cloud security management across the Cloud infrastructure, letting organisations look at their Cloud environment, monitor for security and compliance risks, and then take action.
• Use firewalls and encryption. As for local servers, firewalls prevent unauthorised access to Cloud-based assets and triggering alerts when they detect a potential attack.
• Make security integral to Cloud implementation. Be proactive and ensure the architecture of your Cloud storage has current and future security needs as a primary consideration. This helps you to maintain security measures and ensures you meeting regulatory requirements.

These examples rely on you taking action to understand what you already have in place in terms of the experience and knowledge needed to manage Cloud security and the processes and technology implemented to ensure it remains protected.  Where there are gaps in knowledge, technology or processes that expose the business to risk, you need to take action.

These steps also demonstrate the importance of detecting attacks as soon as a threat arises and then responding to a threat by decisively shutting it down, starting the recovery process and managing a thorough investigation to prevent it from happening again.