Protecting enterprise cloud infrastructure takes more than perimeter defenses: organizations need to govern identities, data, configurations, APIs and security telemetry across the services they use. The 15 practices below form a practical checklist—not a list issued verbatim by NIST or CISA—and should be adapted to each provider, service model and workload.
How cloud service models change the security work
The controls an organization can configure and the visibility it receives differ between infrastructure, platform and software services. NIST SP 800-210 addresses access control across IaaS, PaaS and SaaS; it is a useful basis for tailoring controls rather than applying one unchanged checklist to every service. See NIST SP 800-210.
As an Amazon Associate I earn from qualifying purchases.
| Service model | Security focus for the customer | What to verify with the provider |
|---|---|---|
| IaaS | Access to infrastructure resources, workloads, data and exposed services. | Which infrastructure controls and security visibility the provider supplies, and which remain customer-managed. |
| PaaS | Access to platform services, applications, data and the identities that use them. | Which platform components and security functions are provider-operated, and what configuration and logs the customer can control. |
| SaaS | User and administrator access, data protection, and the settings exposed to the customer. | Which controls, audit information and configuration options are available to the customer for that service. |
This table describes areas to assess, not a universal division of responsibility: exact boundaries and capabilities vary by provider and service. NIST’s public-cloud security guidance discusses security and privacy considerations in public cloud computing, while CISA’s cloud architecture reference addresses cloud security services and cross-environment operations. Consult the NIST SP 800-144 and CISA Cloud Security Technical Reference Architecture.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →15 cloud infrastructure security best practices
1. Inventory accounts, workloads, data stores and exposed services
Build a current inventory across cloud accounts and subscriptions, including workloads, storage and services reachable from outside the organization. Without a reliable inventory, teams can miss assets when assessing access, configuration or incident scope.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
2. Assign an owner to every resource and control
Record who is accountable for each resource and each security control. Make ownership clear across infrastructure teams, application teams, data owners and security operations so that findings and required changes have an assigned destination.
3. Document the shared-responsibility boundary
For each provider and service, identify which security tasks the provider performs and which the organization must configure, monitor or investigate. Capture the boundary in implementation guidance for the teams operating the service; do not assume that a capability available in one service is available in another.
4. Centralize identity where practical and govern its lifecycle
Where the architecture supports it, use centralized identity and single sign-on to manage access consistently. Define how accounts are created, changed and removed, and how privileged access is governed. Verify current provider-specific identity features and settings before writing operational procedures.
Free tools Windows power users keep installed
One-click scans. No signup required.
5. Grant least privilege and review permissions
Use roles or policies to grant only the access needed for a job. Review permissions when people change roles, services evolve or teams reorganize, and remove access that is no longer required. NIST SP 800-210’s model-specific access-control guidance can help frame these reviews.
6. Apply access policies to applications and services, not just people
Cloud-native systems depend on identities for applications and services as well as human users. Make authentication and authorization decisions based on identity and policy, rather than treating network location as sufficient evidence of trust. NIST SP 800-207A addresses zero-trust access control for cloud-native applications in multi-cloud environments: NIST SP 800-207A.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
7. Protect tokens and assertions through verification and lifecycle controls
Tokens and assertions can be targeted for theft, forgery or misuse. Define how they are verified, how their signing keys are managed and how their lifecycle is handled. NIST IR 8587, published September 15, 2026, provides implementation guidance on these protections: NIST IR 8587.
8. Manage secrets with controlled access and protected keys
Control who and what can access secrets, protect the keys associated with them, and establish a rotation approach that fits the system’s operational needs. There is no single rotation interval established here for every workload; set and document one based on the secret, its use and the organization’s requirements. CISA identifies secrets management alongside access control, token validation, logging and forensic capability in its July 15, 2025 article on cloud identity security: CISA, Securing Core Cloud Identity Infrastructure.
9. Encrypt sensitive data and communications appropriately
Use encryption where appropriate to protect sensitive information, choosing controls in light of the data class and the service involved. Verify what the service supports and which configuration or key-management responsibilities remain with the customer; do not assume the same options exist across services.
10. Harden configurations and reduce unnecessary exposure
Review cloud configurations and remove services or access paths that are not needed. Base implementation steps on the current provider documentation for the specific service, because settings, interfaces and capabilities can differ and change.
11. Collect security logs centrally
Where practical, bring security logs together so responders can investigate activity across services and environments. Set retention according to organizational and investigative requirements, and confirm that the events needed for an investigation are actually available. CISA’s Cloud Security Technical Reference Architecture describes centralized cloud security services as part of an architecture that can support incident response and threat hunting.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
12. Protect APIs and the data that passes through them
Include APIs in the security design: control permissions for provider and customer APIs, and protect API inputs and outputs. Check how API access is authorized and what telemetry is available for investigating its use. CISA’s reference architecture includes API and telemetry guidance: CISA Cloud Security Technical Reference Architecture, API and telemetry guidance.
13. Monitor access and change across cloud and on-premises environments
Track changes and access across cloud and on-premises systems, not only within a single account or provider. Normalize telemetry where feasible so investigators can correlate events across environments. This is especially important in hybrid or multi-cloud deployments, where otherwise separate records can make a shared incident harder to reconstruct.
14. Test incident response and forensic access
Exercise the response process and establish whether the organization can obtain and correlate the logs needed to investigate an identity compromise. Include the people responsible for cloud services and security operations, and address gaps in access to evidence before an incident requires it.
15. Reassess controls when the architecture or assumptions change
Review controls when a service model, architecture, provider capability or threat assumption changes. A control suited to one model may not transfer unchanged to another: NIST SP 800-210 distinguishes access-control considerations across IaaS, PaaS and SaaS, while NIST SP 800-207A addresses cloud-native applications in multi-cloud environments.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to prioritize the checklist across environments
In a single-cloud deployment, consistent identity governance and centralized telemetry can help teams manage access and investigate activity within that environment. In hybrid and multi-cloud estates, the same goals require deliberate attention to identity across users, applications and services, plus the ability to correlate records across providers and on-premises systems. CISA’s 2021 architecture reference addresses centralized security services and cross-environment threat hunting; it does not establish that every provider exposes identical capabilities.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteUse the checklist as a way to locate ownership and visibility gaps, then verify each control against the provider’s current documentation and the specific service in use. NIST publications provide standards-oriented guidance, not a guarantee that a particular configuration will secure every enterprise workload.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
