Top 5 Cloud Security Best Practices
Matthew Tinney
A Focused, Compassionate Visionary, Father of Twin Boys. We help Information Technology engineering teams solve for problems they don't have the DNA to solve because they don't have the people, technology or process.
Cloud is the new future and every other company is trying to find their way into a secure cloud computing environment. However, since the beginning of this trend, the biggest concern for these companies has been the safety and confidentiality of their data.
Despite many native security tools from cloud providers like Microsoft, the need for robust security measures within organizations has never been more crucial. In this article, we will explore the five essential best practices that every organization must adopt to safeguard their sensitive information effectively.
Let’s tackle the elephant in the room…
1. Taking Charge of Your Security Obligations
When you use cloud services to store your data, it’s important to know who is in charge of its safety. Generally, the cloud provider is responsible for securing the overall system, but it’s still up to you, the customer, to ensure that your data is secure within that system.
You need to make sure you understand your role and take the necessary steps to protect your data. No doubt, as companies move to the cloud, more and more responsibilities are handled by the cloud provider, in this case, Microsoft. However, it’s always your job to maintain and secure your data, devices, and user accounts.
The Shared Responsibility Model of Cloud Security
The shared responsibility model defines the responsibilities of cloud service providers (CSPs) and cloud users to properly maintain all aspects of the cloud environment, including:
In the context of Microsoft 365 (M365), the CSP is Microsoft, and the cloud user is the organization that subscribes to M365 services.
Responsibility of the Cloud Provider Microsoft is responsible for the security and reliability of the underlying infrastructure that hosts M365 services, including data centers, networks, and hardware. Microsoft also provides security features and controls that help organizations protect their data and applications in M365.
Responsibility of the organization that subscribes to Microsoft Cloud Services
The organization that subscribes to Azure cloud is to secure their data and applications in M365. This includes tasks such as:
The shared responsibility model allows organizations to benefit from the security and scalability of the cloud while maintaining control over their data and applications. By understanding the responsibilities of both the CSP and the cloud user, organizations can make informed decisions about how to secure their M365 environment.
Recommended by LinkedIn
The Shared Responsibility Model Varies from One CSP to Other
It is important to note that the shared responsibility model can vary depending on the specific cloud service that is being used. For example, organizations that use Microsoft Azure will have different responsibilities than organizations that use Microsoft 365. It is important to read the documentation for the specific cloud service that is being used to understand the specific responsibilities of both the CSP and the cloud user.
2. Strong Authentication & Encryption
Passwords do provide the initial defense against unauthorized access, but it’s still important to acknowledge that passwords can be stolen, leaked, or compromised. That’s why it’s crucial to implement robust authentication methods such as multifactor authentication (MFA). They significantly reduce the risk of unauthorized access to your sensitive data. Multifactor authentication involves users providing multiple forms of authentication, such as a password along with a code sent to their mobile app, before gaining entry to the cloud environment.
Importance of Multifactor Authentication (MFA) MFA tech has advanced a lot. They include, most famously, Passwordless technologies. Such technologies still provide the most effective defense against password-related threats. They include facial recognition, fingerprints, or logins through mobile apps.
MFA Capabilities with Microsoft’s Cloud Microsoft offers a range of passwordless technologies like Windows Hello, Microsoft Authenticator, and FIDO2 Security keys. By leveraging these methods, you can greatly reduce the possibility of password theft. However, making their well-optimized use can be a challenge and we are here help you with implementing MFA technologies
The Layered Authentication Architecture By using a layered authentication architecture, Microsoft 365 helps to protect user accounts from a variety of attack vectors.
Pre-authentication: This layer occurs before the user attempts to sign in. It involves checking the user’s IP address and device information to see if they are from a trusted location.
Authentication: This is for when a user tries to sign in. It involves verifying the user’s identity using one or more of the methods.
Authorization: This layer determines what resources the user can access once they have been authenticated.
Cloud Security Relies Heavily on Encryption Encryption involves encoding data to ensure only authorized users can access it. By implementing encryption for both data in transit and data at rest, you can protect sensitive information against unauthorized access and potential data breaches. Microsoft prioritizes encryption across its cloud services, ensuring that data is always encrypted at rest, in transit, and in use. Microsoft Azure Storage Service Encryption, for instance, uses 256-bit AES encryption with Microsoft Manage Keys to encrypt data at rest in various Azure services such as:
Moreover, Azure Disk Encryption provides encryption for data at rest in Windows and Linux VMs using 256-AES encryption. For Microsoft Azure SQL Database and Azure Data Warehouse, Transparent Data Encryption is utilized to provide encryption for these services.