How do you create a secure culture for cloud users?

I suggest easy steps for a secure Org culture: 1. Establish security policies and guidelines covering access control, data protection, and compliance. 2. Educate and train users on security risks, including password management, phishing, and data protection. 3. Regularly communicate security updates and best practices to cloud users. 4. Implement robust security controls like encryption, authentication, and logging. 5. Continuously monitor and audit cloud usage to detect and prevent security incidents. 6. Celebrate and reward achievements in building a secure cloud culture. Transforming the culture is essential for successful cloud adoption and maximizing its benefits. 🔒🌐 #CloudSecurity #CyberAware #CultureTransformation

If you are coming from a practical IT experience, policies may seem a waste of time on unuseful documents. But they actually form the backbone of your technical controls. They can also support you in legal issues when needed. There are many standards from the like of ISO and NIST to help you in this.

Training is important because your users may be unaware of dangers in putting the organization data in the cloud. There are many nuances here like data sovereignty and ownership.

Many of the cloud providers, especially the big ones, offer built-in tools and dashboards to help you in this. There are also many 3rd party providers, tools, and services which can integrate into your environment and help you in this.

Depending on the CSP, a company can choose to enable logging at the role, user, project or service level, e.g. AWS Cloudtrail or AWS Cloudwatch. The equally important next step is to review log activities and have stakeholders determine the most feasible frequency of those log reviews.

Encryption is one of the important controls in the cloud. Customer managed/provided keys offer more security in comparison to the cloud managed keys, although they can be more sophisticated. Related concepts include data shards and cryptographic erasure (as you don't have complete access to the storage devices).

Culture is something that’s built into how we operate, interact and go about our work. So there needs to be a part of laying a ground work of security and embedding it in various processes - employee onboarding, transfers, SDLC, etc. The other aspect is to reenforce those behaviors through regular reminders - eg. Phishing simulations, security awareness, security courses, etc.

There are specialized security trainings and certifications for the cloud security. Examples include CCSP from ISC2 and also CCSK from CSA. CSA is an organization dedicated to the cloud security. They offer more than certifications. They also have many documentations for the cloud security standards and controls. OWASP top 10 can help you to identify the top threats to the cloud. You are usually not able to gain full visibility of the internals of a cloud provider. But you can ask for a 3rd party independent audit report like SSAE 18 SOC 2 Type II. Depending on your workloads, you can also ask if the CSP is compliant with HIPAA, PCI DSS, GDPR, SOX, FedRAMP, and many more.