In a cloud environment, the provider secures the underlying infrastructure while the customer secures its data and workloads. This division changes where an organization must direct its own security effort: using a cloud service does not remove the need to check customer-controlled configurations. section 10.5.1
Turn that division into operational checks:
- Check cloud storage permissions, encryption policies, IAM roles, and security groups for insecure configurations. section 10.5.1
- Detect newly deployed workloads that may be misconfigured or compromised, even when workloads are created and removed rapidly. section 10.5.1
- Give teams clear security ownership, shared metrics, and role-relevant training so responsibilities are carried out consistently. section 5.2 section 7.2
A newly deployed workload
A company deploys a cloud workload and checks whether its storage permissions and IAM roles meet policy. AWS Config or Azure Policy can help assess those configurations. The practical question is not whether the provider secures its infrastructure, but whether the company has secured the settings and workload it controls. section 10.5.1
