Cloud security operates on a shared responsibility model. The customer is responsible for security in the cloud, while the provider is responsible for the security of the cloud itself. When a cloud security incident occurs, the first question many managers ask is: did the provider fail?
In very few cases, the answer is yes. AWS, Azure, and Google invest more in securing their infrastructure than most companies could afford to invest on their own. That is usually not where the problem occurs. It happens one level higher – in how a company configures the areas that fall under its own responsibility.
Excessive permissions
The most common mistake is simple: someone is given more permissions than they actually need to do their job. A developer is assigned a highly privileged role across the entire account "just to get things moving faster." It sounds like a harmless shortcut until their account is compromised through an ordinary phishing email. The attacker then gains access not just to one server, but potentially to the entire environment, including backups.
With a restricted role that allows the developer to work only with their own resources, the same attack would cause far less damage. The difference between "one application compromised" and "the entire environment compromised" can come down to a single misconfigured permission.
Publicly exposed ports and resources
The second common mistake is even easier to explain: a server that does not need to be visible from the internet is exposed anyway. Administrative access via RDP or SSH left open directly to the internet is one of the most common entry points for brute-force attacks.
There are ways to maintain remote administration without taking this risk – secure access through a private tunnel or temporarily opening a port for a limited period with approval required. What is not exposed to the internet cannot be scanned or attacked directly from outside.
Missing MFA and weak identity management
Multi-factor authentication should now be standard without exception, for both regular users and administrators. Yet in practice, there are still accounts, particularly older or service accounts, that bypass this requirement.
Another bad practice is assigning access rights directly to individual users instead of groups. With dozens or hundreds of individual assignments, companies lose visibility into who has access to what. Without that visibility, it becomes extremely difficult to quickly determine what happened and who had access during an audit or security incident.
Untested backups and forgotten resources
Companies worry about losing data, yet often treat backups as a formality that is configured once and then forgotten. A backup you have never successfully restored is not a guarantee – it is only an assumption.
Slovakia experienced this first-hand during the cyberattack on the real estate cadastre in January 2025. Attackers encrypted data, and because backups were accessible from the same affected network, they first had to be checked for possible compromise rather than being immediately available for recovery.
The same applies to resources that someone created and then forgot about: disks detached from deleted servers, old public IP addresses, or test environments still running months after a project has ended. They are not only an unnecessary cost. They are unmanaged potential entry points that the security team may not even know exist.
What this means for you
Most cloud security incidents are predictable and can be prevented without purchasing another tool. The key is to consistently use the security capabilities the cloud already provides.
A good starting point is to regularly monitor your environment's security score and address recommendations based on which improvements deliver the greatest impact with the least effort. Another useful step is to enable existing services that automatically monitor for security incidents. Often, a single configuration change can significantly improve your security posture.
A question for you: When was the last time you checked who has the Owner role in your organization – a role with access to everything – and whether they actually need it?
SP Software Solutions | Just Cloud IT