Cloud security: what the experienced already know

For a small business, "the cloud" is rarely a data center decision. It is a mail and document platform, an accounting package, a customer database, a payments provider, a file-sharing tool, and a dozen smaller subscriptions somebody signed up for with a company card. Examples include Microsoft 365 or Google Workspace for mail and documents, Dropbox for file sharing, QuickBooks or Xero for accounting, and Stripe for payments. The controls and menu names differ by service.

The single idea that makes this manageable is the shared-responsibility model, or division of labor. Your provider secures things you could not secure yourself: the buildings, the hardware, the hypervisor, the platform's own code, the patching of the service. What remains on your side of the line is a short and specific list, and it is where essentially every small-business cloud incident originates.

What to take away

What is still yours

Who can log in, and how. The provider gives you the controls; enabling them is your job. If multi-factor authentication (MFA) is off, that is your configuration, not their vulnerability.

How the service is configured. Sharing defaults, permission models, retention settings, external access: all yours.

What data you put in, and who you share it with. A document shared to the whole internet was shared by someone with an account.

Which third-party applications you connect. Every integration you approve holds standing access.

Whether you can get your data back. Both from the provider's failure and from your own mistakes.

Knowing which services you use at all. You cannot secure a subscription you do not know exists.

Everything below is one of those six.

Sharing links are the most common cloud data leak

The typical exposure is not an intrusion. It is a document shared with "anyone with the link" three years ago, indexed or forwarded, still live.

Find out what your file platform's default sharing setting is, because most people never change the default. For example, Google Drive has an "Anyone with the link" option, and OneDrive and SharePoint can offer an "Anyone" link type when the organization allows it; check what is enabled for new links in your account. If it is set to create publicly accessible links, change it so that the deliberate act is opening access rather than restricting it.

Set link expiry where the platform supports it, so that the ad-hoc share made for one meeting does not become permanent. Look at whatever report your platform offers of externally shared items (most have one, most administrators have never opened it), and work through anything shared broadly that holds customer, financial, or personnel data.

Then teach the one habit that actually helps: share to named people rather than to a link, whenever the extra ten seconds is affordable. Named sharing can be revoked and audited. A link cannot be un-forwarded.

The tenant administrator problem

Small businesses concentrate administrative power to an alarming degree. Frequently one person holds the administrator account for the mail platform, the domain registrar, the accounting system, and the payment provider, protected by one phone.

That is two distinct risks in one place. If the account is compromised, everything is compromised at once. If the person is unavailable (ill, departed, holding a broken phone), the business cannot administer itself.

Record which mailbox gets password resets for each critical service. That mailbox is the master key to it. Full details: identity and access.

Connected applications are invisible access

When someone approves a third-party tool's request to read their mail or files, the resulting access is granted to the application, not the session. It usually survives a password change. It is not visible on any screen the user looks at daily. And it persists after the person who approved it leaves, until somebody revokes it.

Open the connected-applications or app-consent screen on your mail and file platforms. Read the list. Remove anything nobody can account for, any tool you stopped using, and anything asking far broader permission than its function needs.

Then find the setting that governs whether ordinary users may approve new applications on their own. Requiring administrator approval adds friction, and on accounts that matter, that friction is worth having.

Retention is not backup

This is the assumption that costs businesses the most, and it is easy to state plainly: your provider's job is to not lose your data. It is not to protect you from deleting it, from a departing employee wiping a shared drive, or from ransomware encrypting files that then synchronise cheerfully to the cloud copy.

Most platforms have a recycle bin and a version history, both with a limited window that is often shorter than the time it takes to notice a problem. Some have longer retention on higher tiers. Almost none of it survives the deletion of the account itself.

Where the answers are uncomfortable, arrange an independent backup of that service. The reasoning is in backup and recovery, and the point about an offline or immutable copy applies to cloud data exactly as it does to a file server.

Can you see what happened?

After an incident you will want to know who logged in, from where, what they accessed, and what they changed. Whether you can answer that depends on features you either enabled beforehand or did not.

Check each important service: does an audit log exist, is it on by default, and how long is it kept? Confirm the retention you need is in the plan you pay for.

Log access and retention vary by service and plan, so confirm what your current plan includes before relying on either. If a log is short, export it periodically so a separate copy remains available.

Turn on alerts for the handful of events worth interrupting someone about: a new administrator, a new mail forwarding rule, an impossible-travel or unfamiliar-location sign-in, and mass download or deletion of files. Alerts nobody reads are worse than no alerts, so keep the set small enough that each one means something.

Questions to put to a vendor before you commit

None of these have universal right answers. They have answers you should have in writing before your data is inside.

The export question deserves emphasis. Run the export during the trial, not at the end of the relationship. An export that produces an unusable format is something you want to discover while you still have the option of choosing differently.

Finding the subscriptions you forgot

Shadow subscriptions accumulate through entirely reasonable behavior: someone needed a tool, signed up with a work address, and it worked.

The list you produce is worth keeping. You will need it when someone leaves, when you fill out a customer security questionnaire, and when something goes wrong and you must know which vendors hold your data.

Keeping that inventory current is the least glamorous and most reused piece of cloud security work you will do.

The United States Federal Trade Commission's general data security guidance for businesses is a free starting point. Which rules apply to your data, in your industry and jurisdiction, is a question for your own legal advisers and your contract counterparties.

Common questions

We are five people using one platform. Is any of this relevant?

The sharing settings and the connected applications are, immediately, because both produce data loss without anybody being attacked. The subscription inventory becomes relevant the moment a second person signs up for something with a company card, which is usually already true.

Our provider says the data is encrypted and backed up. Is that not enough?

Those two claims protect against their failures, not yours. Neither prevents a document being shared to the whole internet by somebody with a valid login, and neither returns a folder deleted four months ago. The protection you still owe is the mail and account work described in phishing defense, plus an independent copy of anything you could not recreate.

How often should the connected applications be reviewed?

Quarterly is enough for most businesses, and after anyone leaves. The list grows quietly because each grant felt reasonable at the time, and the review takes ten minutes once you know where the page is.

Somebody signed up for a service on a personal card. What now?

Move it onto the inventory rather than punishing anyone, since the alternative is that the next one stays hidden. Assign an owner, check the second factor and the sharing defaults, and decide whether it stays. The general reasoning about services you did not know existed is the same one that applies to devices in endpoint security.

Where should we read further?

The United Kingdom National Cyber Security Centre's cloud security collection organizes its material around the same division of responsibility used above. And the ordering of work in security foundations puts the accounts and the inventory ahead of anything else on this page.