Headline: The Cloud Changes Everything — Here's How to Adapt Your Controls for Cloud Environments
The Cloud Control Challenge
Traditional controls were designed for on-premises environments. The cloud introduces new risks and requires different control approaches:
- Shared responsibility model: The cloud provider controls some aspects; the customer controls others
- Dynamic environments: Resources are created and destroyed continuously
- API-driven operations: Changes happen through APIs, not manual processes
- Identity-centric: Access is the primary security control
The Shared Responsibility Model
|
Responsibility |
Customer |
Provider |
|
Data classification |
? |
|
|
Identity and access management |
? |
|
|
Network and application controls |
? |
|
|
Host/container security |
? |
|
|
Physical security |
? |
|
|
Infrastructure security |
? |
|
|
Hypervisor security |
? |
Adapting Controls for the Cloud
Access Controls
|
Traditional Approach |
Cloud Approach |
|
On-premises AD groups |
Cloud-based identity providers (Azure AD, Okta) |
|
Manual access reviews |
Automated access reviews |
|
Static role assignments |
Dynamic role assignments with PIM/PAM |
|
VPN access |
Zero Trust access (Zscaler, Cloudflare) |
Monitoring Controls
|
Traditional Approach |
Cloud Approach |
|
On-premises SIEM |
Cloud-native monitoring (CloudTrail, CloudWatch) |
|
Periodic vulnerability scans |
Continuous vulnerability scanning |
|
Manual log reviews |
AI-powered anomaly detection |
|
Limited observability |
Full observability |
Configuration Controls
|
Traditional Approach |
Cloud Approach |
|
Manual configuration management |
Infrastructure as Code (IaC) |
|
Periodic compliance checks |
Continuous compliance scanning |
|
Manual change management |
CI/CD pipelines with integrated security |
|
Static configuration baselines |
Dynamic configuration baselines |
The SaaS Risk Challenge
SaaS creates a dynamic risk surface. Modern GRC programs need SaaS-aware risk assessment and third-party governance, not just policies .
Key SaaS control areas:
- Discovery and inventory: Know what SaaS applications are in use
- Access and privilege models: Understand who has access and with what permissions
- Configuration baselines: Ensure SaaS applications are configured securely
- Third-party integrations: Assess risk from connected apps and extensions
- Backup and recovery: Ensure data is protected
Identity Context in the Cloud
The integration of identity data into the CMDB is particularly important in cloud environments :
- A risk-aware business lens connects identity-derived risk signals to business services
- Incident prioritization can factor in identity risk
- Automated control mapping supports threat modeling and impact analysis
Conclusion
Cloud environments require adapted controls. Organizations that adapt their controls for cloud environments—with cloud-native monitoring, identity-centric access controls, and continuous compliance—will maintain effective control coverage.
Action Items for Your Organization
- Assess your cloud control coverage
- Identify gaps in cloud controls
- Adapt access controls for cloud environments
- Implement cloud-native monitoring
- Use Infrastructure as Code for configuration controls
- Implement SaaS governance
