01The shared responsibility model across IaaS, PaaS and SaaS
Cloud provider and customer share responsibility for security – exactly how depends on the service model. With IaaS, the customer is responsible for the operating system, network controls and applications; with PaaS, the provider takes over the operating system while application and network configuration remain shared; with SaaS, almost the entire stack sits with the provider. Regardless of the model, however, four areas always remain with the customer according to Microsoft's responsibility matrix: data, endpoints, accounts and access management – as do configurations and settings. The most common misconception is “the provider takes care of security”: particularly with SaaS, responsibility for access and configuration is regularly underestimated, and without explicit assignment, shared responsibilities remain effectively unowned.
02Identity is the new perimeter
In the cloud, the management plane and APIs are reachable over the internet – anyone holding valid credentials is not standing in front of the firewall but right inside the environment. Accordingly, the Cloud Security Alliance ranks Identity and Access Management second in its Top Threats 2024. Effective countermeasures include consistent, ideally phishing-resistant multi-factor authentication, least-privilege roles instead of standing administrator rights, separate and closely monitored privileged accounts, and short-lived credentials. Non-human identities – service accounts, API keys, workload identities – belong under the same governance, as they are frequently overlooked in access reviews and rarely recertified.
03Misconfigurations and inadequate change control
“Misconfiguration and Inadequate Change Control” ranks first in the CSA Top Threats to Cloud Computing 2024. Typical patterns include publicly accessible storage buckets, overly broad IAM roles, exposed management interfaces, disabled logging, and forgotten test and shadow resources. The root cause is rarely a lack of knowledge but speed: self-service and infrastructure as code generate daily changes that no one reviews consistently without guardrails. Remedies include policies defined as code (Policy as Code), Cloud Security Posture Management (CSPM) for continuous detection of drift, and a change process that explicitly covers cloud resources as well.
04CSA Top Threats: what the industry rates as a risk
For its “Top Threats to Cloud Computing” series, the Cloud Security Alliance regularly surveys practitioners; for the 2024 edition (published in August 2024), more than 500 experts prioritized eleven threats. The top three spots go to misconfiguration and inadequate change control, Identity and Access Management, and insecure interfaces and APIs – all of them topics within the customer's area of responsibility. The complementary report “Top Threats to Cloud Computing - Deep Dive 2025” (April 2025) analyzes eight real-world security incidents along this threat framework and derives control recommendations from them; the focus is on human error, identity and configuration weaknesses, and supply chain risks.
05Landing zones, baselines and multi-cloud governance
A landing zone is a pre-structured cloud environment in which governance, networking, identity and logging are anchored before the first workload moves in. Microsoft's Cloud Adoption Framework distinguishes a central platform landing zone and dedicated application landing zones per workload, which automatically inherit security policies through the management group hierarchy. The consensus-based CIS Benchmarks have established themselves as the configuration baseline – more than 100 benchmarks for over 25 product families, including AWS, Azure, Google Cloud and Oracle Cloud. For assessing providers in the German market, the BSI's C5 criteria catalogue is also relevant; it was fundamentally revised in 2025/26 (C5:2026). In multi-cloud environments, consistency matters more than any single tool: uniform policies, central identity governance and consolidated logging across all platforms.
06Getting started with a cloud security program
Getting started begins with visibility: which cloud accounts, services and data exist – including the environments that never went through an architecture review? This is followed by clarifying responsibilities per service model and securing the two biggest levers: identities (MFA, privileged access) and central logging. Next, a baseline such as the CIS Benchmarks is made binding and its adherence measured continuously with CSPM tools instead of being audited only at intervals. Cloud security is a program with ongoing operations – with defined roles, metrics and change processes – not a one-off hardening project.
