Proportionate practice.
WHAT MATTERS MOST
A second authentication step on every account Individual accounts, minimum permissions Public access checked and closed Billing alerts Access removed when people leave
THAT LIST PREVENTS MOST CLOUD INCIDENTS
WHAT DOES NOT MATTER MUCH AT SMALL SCALE
Elaborate tooling Complex policy frameworks Monitoring nobody reads
WHAT TO DO MONTHLY
Check what is running Check the bill Check login activity
WHAT TO DO QUARTERLY
Review accounts and permissions Review what is publicly accessible Review credentials in use
WHAT TO DOCUMENT
Which services you use, who administers them, and what data each holds.
WHAT TO TELL YOUR TEAM
Not to adopt business services without telling you Not to place business data in personal accounts To report anything odd immediately
WHAT TO PROVIDE
Approved services that meet the need.
WHAT TO AVOID
Controls so onerous that people use their own accounts instead.
