Cloud security audit: what does an auditor look for in AWS, Azure and Google Cloud?

The adoption of cloud services is growing exponentially. Organizations run their applications and data on AWS, Microsoft Azure or Google Cloud Platform. But migrating to the cloud introduces new security risks that are fundamentally different from those of a traditional on-premises environment. A cloud security audit maps out these risks.

The shared responsibility model is the starting point of every cloud security audit. The cloud provider is responsible for the security of the infrastructure (security of the cloud), while the customer is responsible for security within the cloud (security in the cloud). Misconfigurations on the customer side are the most common cause of security incidents.

Identity and access management (IAM) is the first area of focus. The auditor assesses whether the principle of least privilege has been applied, whether MFA is enforced for all administrative accounts, whether service accounts have minimal permissions, and whether there are no hardcoded credentials in code or configuration.

Network configuration is the second area of focus. Are security groups and network ACLs configured correctly? Is traffic between components encrypted? Are there unintentionally publicly accessible resources such as S3 buckets, storage accounts or databases? Are VPN connections or private endpoints set up for sensitive traffic?

Data security forms the third area of focus. The auditor checks whether data at rest and in transit is encrypted, whether encryption keys are managed securely (preferably via a managed KMS), and whether sensitive data is not unintentionally stored in logs, snapshots or temporary storage.

Logging and monitoring are the fourth area of focus. Are CloudTrail, Azure Activity Log or GCP Audit Logs enabled? Are these logs collected and analyzed centrally? Are alerts set up for suspicious activity? Is there an incident response process aligned with the cloud environment?

Finally, the auditor assesses compliance aspects. Does the data run in the correct region in accordance with the GDPR? Are the services used compliant with relevant standards? Does the cloud provider offer the necessary assurance reports (SOC 2, ISO 27001)?

Secure Audit performs cloud security audits for organizations running on AWS, Azure or Google Cloud, from configuration review to full compliance assessment. Contact us for a cloud security assessment.