We moved the company entirely to the cloud, but where do we start with a cloud security assessment?

The very first thing you should do is check your storage permissions. While cloud providers usually keep buckets private by default, people often set them to public read access during migrations just to make things easier. Also, check whether management ports on your virtual servers (especially SSH or RDP) are open to the entire internet. Restrict them strictly to your office's static IP address.

We run a financial brokerage office of similar size. When we received a similar vendor questionnaire last year, we hired an independent security consultant. They billed us 2,200 GBP for a four-day configuration review. The resulting report flagged eight critical vulnerabilities, six of which were just misconfigured user permissions. If you do the basic cleanup yourselves before an external audit, costs drop significantly.

tell your it guy right away to enforce u2f security keys or an authenticator app on all admin accounts... sms verification isn't considered secure anymore. anyway the first thing they look at on client audit forms is usually your mfa policy anyway.

Internal reports based on canned checklists downloaded off the internet won't satisfy most enterprise clients. Many checklists just ask about policies that exist on paper without showing actual vulnerabilities in the system. If your client has to run the audit form by their risk department, it'll be very tough to sign that contract without a signed external assessment report.

Here's what you need to knock out on day one of your internal audit: 1) Enforce two-factor authentication on all employee logins. 2) Revoke old, unused API keys and service accounts created during the migration. 3) Open up your cloud provider's built-in security alert dashboard and resolve the high-priority risks one by one. 4) Verify that your data backups are kept isolated in a different region.

Didn't the contractor who handled the migration leave you handover documentation? That document should state which virtual resources were set up, where encryption keys are stored, and how the database is protected. If you don't have something like that, shouldn't your first step be going back to the contractor and demanding a system inventory?

The security questionnaires sent by enterprise clients are usually based on international information security standards. These forms will ask whether your system has undergone penetration testing and what your incident response plan is. Your in-house tech person can patch basic misconfigurations, but obtaining an independent report for legal commitments given to the client will protect you from future liability.

The quickest thing you can do tomorrow morning is open the built-in security and compliance center in your cloud dashboard. Providers usually offer a free security score alongside a list of deficiencies. Even just fixing the critical red alerts and grabbing a screenshot is a good first step to show the client that the process is underway.

I'd appreciate it if you shared the outcome. When making decisions, write down the worst-case scenario too, not just the best.

That's all, sorry if I went on too long.

Let me summarize what's been said so far. The harder it is to reverse a decision, the slower you should make it.

Forgotten test environments are more often the entry point than live systems. If you have questions, write them; I'll answer as best I can.

We've heard this a lot but it never happened like that for us. Just because everyone does it doesn't mean it's right.

If you dont write this down from the start it leads to arguments later. Of course it varies if your situation is different.

I felt relieved reading this answer, so it's not just me. When making a decision, first look at what data you have on hand.

I'm curious too. Everything goes well for the first three months; problems arise in the fourth.

This is my opinion, I'm not claiming it's absolute truth.

I have a question, don't want to go off-topic though. Most incidents start with a leaked password, not a vulnerability.

Proven by experience.

There is something to watch out for. If it's your first time, start small; scaling comes later.

If you have questions, write them; I'll answer as best I can.

There's a trap here, let me mention it. The real issue isn't the number, but what it's based on.

Good luck with that.

To get into the details: The biggest time-waster for us was not knowing who had the final say.

Processes without records never improve, because you don't know what to fix.

How did you solve this? I mean when making a decision first look at what data you have on hand.

If I were you I'd go this route.