Cloud Security Checklist: 5 Must-Have Controls for SMBs

Did you know that over half of all cyberattacks target small and medium-sized businesses (SMBs)? And 60% of those affected shut down within six months of a breach. Protecting your cloud systems doesn’t have to be expensive or complicated. Here are five essential security controls every SMB should implement:

1. Multi-Factor Authentication (MFA): Adds an extra layer of protection to prevent unauthorised access.
2. Data Encryption: Secures sensitive information both at rest and in transit.
3. User Access Management: Limits access based on roles to reduce risks.
4. Security Monitoring Tools: Detects and alerts you to suspicious activity in real time.
5. Regular Security Assessments: Identifies vulnerabilities and ensures defences stay effective.

These steps create a strong foundation for safeguarding your cloud environment. Start with simple measures like enabling MFA and using built-in encryption tools from your cloud provider. Regularly review access permissions and monitor your systems to stay ahead of threats. SMBs can protect themselves without breaking the bank - security is a continuous journey, not a one-time fix.

Cybersecurity Essentials for SMBs: Mastering IT Security to ...

1. Setting Up Multi-Factor Authentication

How MFA Works

Multi-factor authentication (MFA) adds an extra layer of security by requiring users to verify their identity using multiple methods. Typically, this involves:

• Something they know: A password or PIN.
• Something they have: A mobile device, security key, or token.
• Something they are: Biometric data such as fingerprints or facial recognition.

By combining these elements, MFA makes it much harder for unauthorised users to gain access.

MFA Setup Guide

Here’s a step-by-step approach to implementing MFA in your organisation:

For Microsoft 365 users, enabling security defaults via the Microsoft Entra admin centre is a straightforward way to implement basic MFA. For organisations needing advanced control, Conditional Access policies offer customisable security options.

MFA Tools for Small Business

When selecting MFA tools, aim for a balance between strong security and user convenience. Different authentication methods offer varying levels of protection:

Highly Secure Methods:

• FIDO Authentication: Uses public-private key cryptography and is widely regarded as the most secure option.
• Authenticator Apps: Generate time-based codes for added security.
• Biometric Authentication: Combines security with ease of use.

Things to Keep in Mind:

• SMS-based authentication is vulnerable to SIM swap attacks and should not be your sole method.
• Pair MFA with Single Sign-On (SSO) to simplify access for users.
• Offer multiple authentication options to accommodate different user needs.

"FIDO authentication, which uses public-private key cryptography, for example, has been dubbed by the Cybersecurity and Infrastructure Security Agency (CISA) as the gold standard and most secure form of MFA."

Focus on applying MFA to high-risk systems first, such as email, cloud storage, VPNs, and any tools used for remote access.

2. Implementing Data Encryption

Types of Data Encryption

Data encryption transforms sensitive information into unreadable ciphertext, ensuring it stays protected. There are two main types to consider:

Data at Rest Encryption
This secures inactive data stored in places like databases, cloud storage, USB drives, or file archives. For example, full disk encryption (FDE) ensures that stored data remains inaccessible without the correct decryption key.

Data in Transit Encryption
This safeguards information as it moves between devices or across networks. It's crucial for securing:

• Email communications
• File transfers
• Video calls
• Chat messages
• Remote access connections

Select the encryption type that aligns with your data's specific needs.

Managing Encryption Keys

Once you've picked the right encryption method, managing the keys securely is critical.

Key Storage and Protection
Keep encryption keys separate from the data they protect. Hardware security modules (HSMs) are a solid choice for secure storage. Also, document where keys are stored and who has access.

Key Lifecycle Management
Follow these practices to maintain control over your keys:

• Use industry-standard algorithms for key generation
• Rotate keys periodically to minimise risk
• Keep secure backups of all keys
• Clearly outline procedures for key destruction when they are no longer needed

Built-in Cloud Encryption Tools

Modern cloud platforms simplify encryption with built-in tools that handle many tasks automatically.

These tools often include:

• Automated Key Management: Services that generate, store, and rotate keys without manual intervention
• Transport Layer Security (TLS): TLS 1.2 or higher for securing data in transit
• Storage Encryption: Automatic encryption for files and databases
• Access Controls: Integration with authentication systems to manage who can access encryption keys

When using cloud encryption, prioritise:

• Categorising data based on sensitivity
• Activating default encryption settings
• Enabling logging and monitoring features
• Setting up access restrictions
• Performing regular security reviews and compliance checks

sbb-itb-424a2ff

3. Setting User Access Limits

Creating Access Roles

Role-Based Access Control (RBAC) helps manage user permissions by assigning access based on job roles. Group your team into specific roles, each with permissions that match their responsibilities.

To implement RBAC effectively:

• Use pre-defined roles provided by your cloud platform.
• Clearly document the responsibilities tied to each role.
• Minimise the creation of custom roles to avoid complexity.
• Group employees with similar functions under the same role.
• Reassess and update role definitions every quarter.

"RBAC is the idea of assigning system access to users based on their role within an organisation." - Robert Covington, Contributor

Once roles are defined, conduct regular reviews to ensure permissions remain appropriate for each user's responsibilities.

Checking Access Permissions

Regular user access reviews (UARs) are essential for spotting unnecessary permissions and reducing security risks. A structured review process ensures consistency and thoroughness.

• Set a Review Schedule: Conduct quarterly reviews for standard accounts and monthly reviews for privileged accounts. Keep records of findings and any resulting actions.
• Examine Current Access: Generate detailed reports showing user accounts, permissions, last login activity, and access patterns.
• Confirm Permissions: Collaborate with department managers to verify that each user's access aligns with their current role.

"User access reviews, also known as user certification, are a critical process that helps security teams, compliance managers, and business owners understand who has access to what and make informed decisions about whether a particular access is necessary." - Keri Bowman, CISA-certified GRC and IGA expert

Temporary Access Management

After standard reviews, it's important to manage temporary access effectively to prevent security gaps. Using Just-in-Time (JIT) access can balance flexibility with control.

Key steps include:

• Setting up time-limited roles that automatically expire.
• Keeping logs of all temporary permissions granted.
• Actively monitoring how these permissions are used.

4. Setting Up Security Monitoring

Central Log Management

Centralised log management collects logs from all cloud services, making it easier to spot unusual activity, maintain an audit trail, and troubleshoot issues.

Key elements of centralised logging include:

• Log Sources
  Enable logging for critical systems like authentication attempts, resource access, configuration changes, system performance, and security alerts.
• Storage Configuration
  Set up log storage with a retention period that meets your investigation and compliance needs.

Take advantage of built-in cloud monitoring tools to gain better visibility into your systems.

"If you need to offload your logs to a remote location, go and use @papertrailapp. Perfect example of a tool that does one thing very well."
– Martin Stiborky, @stibi

Cloud Monitoring Tools

Most modern cloud platforms come with built-in monitoring tools that provide insights into your security status. Track key metrics like access events, resource usage, network irregularities, and API activity. Adjust alert thresholds to match what’s normal for your operations.

Blumira reports their detection time is 99.4% faster than the industry average. This kind of speed can make all the difference in stopping an attack before it escalates.

Once monitoring is in place, setting up clear and actionable alerts is the next step.

Security Alert Setup

Alerts should notify your team of security issues without causing alert fatigue. Categorise events into critical, high, medium, and low priorities, and assign specific actions for each. Use SMS or phone calls for critical alerts, while lower-priority notifications can go through email or messaging apps.

"Graylog takes their time to help engineer the product to suit your needs. Their support is a partnership and is a testament to what a company should be."
– Gartner Peer Insights Review

Regularly reviewing and adjusting alert thresholds is essential for effective monitoring. Mike Morrow, Technical Infrastructure Manager at Ottawa County, highlighted this on Blumira's website: "Blumira has saved us time because we can't monitor all of our logs manually, which would require a team of 100".

5. Running Security Checks

Security Scanning

Automated security scanning is a must to spot vulnerabilities before they can be exploited. Use scanning tools to check for misconfigurations and security issues across your environment.

Focus on these areas during scans:

• Infrastructure: Check cloud resource configurations for errors.
• Vulnerabilities: Identify outdated software and weak points in your system.
• Access Controls: Ensure permissions and identity management are set up correctly.
• Network Security: Review firewall rules and network configurations.

Tools like Snyk can help developers find and fix issues in code, open-source libraries, containers, and infrastructure as code.

Security Testing

After scanning, test your system by simulating threats to see how well your defences hold up. For example, Aqua Security's Cloud Security Posture Management (CSPM) platform can help detect and address risks as they arise.

Key testing areas include:

• Automated Checks: Regular automated tests to ensure consistent security. Platforms like CloudCheckr offer continuous assessments of configurations.
• Access Control: Test authentication methods and resource isolation to confirm they function as intended.
• Incident Drills: Run scheduled drills to practise quick recovery from simulated security breaches.

Compliance Checks

The Cloud Security Alliance's CCM Lite provides 91 controls tailored for small and medium-sized businesses (SMBs).

To stay compliant, consider these steps:

• Keep detailed records of security measures and compliance evidence in a secure location.
• Review and update security controls every quarter.
• Maintain logs of all security-related activities.
• Encrypt sensitive data, both when stored and during transmission.

Qualys' Enterprise TruRisk Management platform offers a centralised view of your security posture, making it easier to spot and fix compliance gaps.

Conclusion: Next Security Steps

Summary of Controls

Securing your cloud environment doesn't need to be complicated, even for SMBs. Here’s a breakdown of five key controls that form a strong defence:

These measures create a reliable starting point for improving cloud security.

Implementation Guide

Here’s how to put these controls into practice for your SMB:

Get the Basics in Place
Use automated monitoring tools to keep an eye on your systems. Take advantage of free trials to test out essential security services before committing.

Build a Security-Focused Team
Provide your team with security training and establish clear protocols for both office and remote work scenarios.

Track What Matters
Keep an eye on important metrics like time-to-mitigation (TTM), the number of security incidents, and how often intrusions occur.

Review and Update Regularly
Plan quarterly security assessments to ensure your defences stay effective. Leverage real-time monitoring tools to quickly spot and fix vulnerabilities, helping you maintain a strong security setup without overextending your resources.