---
title: Best practice tips for securing your cloud
description: The renewed focus on digitalisation & hybrid working means cloud is the new normal. We consider what that means for your cyber security approach.
image: https://blog.grantmcgregor.co.uk/hubfs/cloud%20security.png
---
[](https://www.grantmcgregor.co.uk/)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
[Contact Us](https://grantmcgregor.co.uk/contact-us)
[Back to main](https://grantmcgregor.co.uk/knowledge-hub/blog)
Digital Transformation
# Best practice tips for securing your cloud
Grant McGregor Team
27 November 2023 • 7 min read
## Whether you are using cloud-based software-as-a-service applications, running email services from your Microsoft 365 tenant or storing data in Microsoft Azure, cloud is the new normal for most organisations.
## The Grant McGregor team considers what that means for your cyber security approach.
The renewed focus on digitalisation and the hybrid working arrangements that have emerged from the pandemic period have accelerated most organisations’ journey towards [cloud computing](https://www.grantmcgregor.co.uk/cloud-services-and-it-solutions) in one way or another.
Cloud is increasingly the de facto choice for applications and data these days. According to research by [Gigamon](https://www.gigamon.com/content/dam/resource-library/english/book/eb-what-is-deep-observability.pdf), 43 percent of organisations are now making use of multiple public cloud and multiple private cloud instances. Some 89 percent are embracing a multi-cloud strategy.
Of course, this brings its own complexity and security challenges.
### How common are cyber-attacks on cloud infrastructure?
Proofpoint’s [The Human Factor 2023](https://www.proofpoint.com/uk/resources/threat-reports/human-factor) report found that 94 percent of cloud tenants were targeted every month.
What’s more, worryingly, there is a gap between malicious cyber activity and business leaders’ perception of it. [Gigamon](https://www.gigamon.com/content/dam/gated/wp-gigamon-survey-hybrid-cloud-security-2023.pdf) has also found that half of the business IT leaders it surveyed were “confident” or “completely confident” they are sufficiently secure across their hybrid cloud infrastructure from on-premises to cloud. Yet of those, 90 percent admitted to having experienced a breach in the last 18 months.
The company says this is proof of a “significant disparity between how secure organisations believe their hybrid cloud infrastructure to be, and how protected their data truly is.”
### How can you secure your clouds?
Of course, it is never “one size fits all” when it comes to cyber security. Different clouds will require different security approaches.
The risks and approaches will vary greatly between:
- Software as a service, such as Salesforce or Microsoft 365
- Cloud platforms, such as Microsoft Azure
- Social clouds which your users may access, such as Instagram or TikTok
However, some of the controls will be the same. The UK’s National Cyber Security Centre (NCSC) points out that single-sign-on solutions (such as Microsoft Entra ID), multi-factor authentication, secure administration and the use of trustworthy devices (ensured through policies in your device management tools) will be essential principles of all your cloud security.
Earlier this year, it issued [new cloud security guidance](https://www.ncsc.gov.uk/blog-post/new-cloud-security-guidance-its-all-about-the-config) to encourage organisations to ensure they take a robust approach to cloud configuration – for both SaaS applications and cloud platforms. It has separated out its advice for each cloud model:
- It emphasises that poor authentication and authorisation configuration is one of the most common sources of security issues in software-as-a-service apps.
- For cloud platforms and the services on running on them, your focus must be on strong observability and using automation to implement a robust cyber security approach.
### NCSC cloud security guidance
The NCSC cloud security guidance is built around 14 principles.
These are:
- **Principle 1: Data in transit protection**
Your data should be adequately protected against tampering and eavesdropping as it transits networks inside and external to the cloud. This should be achieved using a combination of encryption, [service authentication](https://www.grantmcgregor.co.uk/cyber-security/safer-data-and-access) and network-level protections.
- **Principle 2: Asset protection and resilience**
Your data, and the assets storing or processing it, should be protected against physical tampering, loss, damage or seizure.
- **Principle 3: Separation between customers**
A malicious or compromised customer of the service should not be able to access or affect the service or data of another. Effective security boundaries should be in place in the way your cloud provider runs code, stores data and manages the network.
- **Principle 4: Governance framework**
Clearly stated, this should direct your provider’s management of the service and information within it.
- **Principle 5: Operational security**
The service needs to be operated and managed securely in order to impede, detect or prevent attacks. This will be achieved through a combination of effective vulnerability management, protective monitoring, configuration & change management, and [incident management](https://blog.grantmcgregor.co.uk/how-to-develop-an-incident-reporting-culture).
- **Principle 6: Personnel security**
Where service provider personnel have access to your data and systems, you need a high degree of confidence in their trustworthiness and the technical measures in place that audit and constrain the actions of those personnel.
- **Principle 7: Secure development**
Cloud services should be designed, developed and deployed in a way that minimises and mitigates threats to their security. This will include a robust software development lifecycle.
- **Principle 8: Supply chain security**
Your service provider should ensure that its [supply chain](https://blog.grantmcgregor.co.uk/is-your-organisation-doing-enough-on-supply-chain-security) meets the same security standards that the organisation sets for itself, especially where they have access to data.
- **Principle 9. Secure user management**
The provider must [prevent unauthorised access](https://blog.grantmcgregor.co.uk/what-is-the-principle-of-least-privilege-and-should-you-be-following-it) and alteration of your resources, applications and data, usually based on a role-based access model.
- **Principle 10: Identity and authentication**
All access to service interfaces should be constrained to a [securely authenticated](https://blog.grantmcgregor.co.uk/how-to-implement-multi-factor-authentication) and authorised identity (either a human user or a machine).
- **Principle 11: External interface protection**
All external or less-trusted interfaces of the service should be identified and defended appropriately. This includes external APIs, web consoles and command line interfaces.
- **Principle 12: Secure service administration**
The design, implementation, and management of the cloud service provider’s administration systems should follow enterprise good practice, recognising their high value to attackers.
- **Principle 13: Audit information and alerting for customers**
You should be able to [identify security incidents](https://www.grantmcgregor.co.uk/cyber-security/safer-devices) and should have the information necessary to find out how and when they occurred. This includes audit information and the issuance of security alerts when attempted attacks are detected.
- **Principle 14: Secure use of the service**
Your cloud provider should make it easy for you to meet your data protection responsibilities. Services should be secure by design and by default.
The NCSC provides much greater detail into all these principles on its website. You should familiarise yourself with the detail so that you are confident discussing them with your cloud service provider.
However, while this advice is a fantastic starting point for shaping your organisation’s cyber security approach to software-as-a-service apps and platform-as-a-service and infrastructure-as-a-service cloud services, it does overlook one important cloud-based threat. Whether you class social networks as shadow IT or not, it is likely some of your users are accessing them via your organisational devices or, at least, the devices they are also using to access your cloud apps and services.
Gigamon has found that only 60 percent of global enterprises have banned the use of WhatsApp due to cyber-security concerns, although this figure does rise for other social networks. The survey found 100 percent of business IT leaders expressed concerns about TikTok and the Metaverse – although not all had blocked them.
Newer cloud services are even lower on the radar. The Gigamon survey found that only 24 percent of global enterprises have banned or are looking at banning Chat GPT. This is, perhaps, one overlooked area that should be considered within your overall cloud security strategy.
### What next?
If you would like more information about any of the concerns, approaches or cyber-security principles discussed in this article, please reach out to our team.
Call us: 0808 164 4142
Message us: [https://www.grantmcgregor.co.uk/contact-us ](https://www.grantmcgregor.co.uk/contact-us)
Further reading
You can find more ideas and advice about cyber security elsewhere on the Grant McGregor blog:
• [New changes to Cyber Essentials for 2023](https://blog.grantmcgregor.co.uk/new-changes-to-cyber-essentials-for-2023)
• [Is your business data at risk? Don’t take chances with old tech!](https://blog.grantmcgregor.co.uk/is-your-business-data-at-risk-dont-take-chances-with-old-tech)
• [What is a watering hole attack? And how can you protect against it?](https://blog.grantmcgregor.co.uk/what-is-a-watering-hole-attack-and-how-can-you-protect-against-it)
• [AI’s new role in cyber security](https://blog.grantmcgregor.co.uk/ais-new-role-in-cyber-security)
• [Is your organisation doing enough on supply chain security?](https://blog.grantmcgregor.co.uk/is-your-organisation-doing-enough-on-supply-chain-security)
• [What can we learn from the Capita data breaches?](https://blog.grantmcgregor.co.uk/what-can-we-learn-from-the-capita-data-breaches)
• [Do your backups include this important information?](https://blog.grantmcgregor.co.uk/do-your-backups-include-this-important-information)
• [Tips for successfully implementing a zero-trust approach to cyber security](https://blog.grantmcgregor.co.uk/tips-for-successfully-implementing-a-zero-trust-approach-to-cyber-security)
Grant McGregor Team
27 November 2023 • 7 min read
## Recent Posts
### Shadow AI: Is Your Business Ready for AI Adoption?
Understand shadow AI's impact on your business. Discover how to assess risks, improve processes, and adopt AI securely w...
[Read More](https://blog.grantmcgregor.co.uk/shadow-ai-is-your-business-ready-for-ai-adoption)
### Our Net Zero Target for 2040: What Can We Change?
From company vehicles and travel to suppliers and technology, see how Grant McGregor is working towards its net zero tar...
[Read More](https://blog.grantmcgregor.co.uk/our-net-zero-target-for-2040-what-can-we-change)
### What Is Penetration Testing? A Guide for Businesses
Learn what penetration testing is, how it works, what the report should include and when your business should consider a...
[Read More](https://blog.grantmcgregor.co.uk/what-is-penetration-testing-a-guide-for-businesses)
### Grant McGregor Recognised as a Leading Global MSP in the 2026 MSP 501
Grant McGregor has been named a Top Global Managed Service Provider in the 2026 MSP 501, ranking #1 Scotland-based MSP a...
[Read More](https://blog.grantmcgregor.co.uk/grant-mcgregor-recognised-as-a-leading-global-msp-in-the-2026-msp-501)
Union
## Empower your business with secure, expert-led solutions.
Talk to us about people-focused technology that drives results.
[Start a conversation](https://grantmcgregor.co.uk/contact-us)
Premium IT Services Tailored for Leading Brands
[Follow us on LinkedIn](https://www.linkedin.com/company/grant-mcgregor-ltd/) [Follow us on Facebook](https://www.youtube.com/itgrantmcgregor) [Follow us on Facebook](https://www.facebook.com/grantmcgregorltd/) [Follow us on Twitter](https://x.com/GrantMcGregorIT)
Quick Links
- [Home](https://grantmcgregor.co.uk)
- [About us](https://grantmcgregor.co.uk/about-us/our-story)
- [Knowledge Hub](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
Services
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
Edinburgh – Chesterfield
[0131 603 7910](tel:+441316037910)
[info@grantmcgregor.co.uk](mailto:info@grantmcgregor.co.uk)
**Main Office:**
The Merchants' Hall,
22 Hanover St,
Edinburgh EH2 2EP
© 2026
Grant McGregor. All rights reserved.
[Privacy and Cookie Policy](https://blog.grantmcgregor.co.uk/hubfs/UsefulDownloads/Policies/GRMC-SEC-Privacy-and-Cookie-Policy.pdf)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Grant McGregor Team",
"url" : "https://blog.grantmcgregor.co.uk/author/grmc-team"
},
"dateModified" : "2025-07-01T13:03:37.540Z",
"datePublished" : "2023-11-27T08:30:00.000Z",
"headline" : "Best practice tips for securing your cloud",
"image" : [ "https://blog.grantmcgregor.co.uk/hubfs/cloud%20security.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.grantmcgregor.co.uk/best-practice-tips-for-securing-your-cloud",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg"
},
"name" : "Grant McGregor"
}
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://grantmcgregor.co.uk/",
"@type" : "LocalBusiness",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "GB",
"addressLocality" : "Edinburgh",
"postalCode" : "EH2 2EP",
"streetAddress" : "22 Hanover Street"
},
"geo" : {
"@type" : "GeoCoordinates",
"latitude" : 55.9526313,
"longitude" : -3.1970679
},
"image" : "https://grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg",
"name" : "Grant McGregor",
"openingHoursSpecification" : {
"@type" : "OpeningHoursSpecification",
"closes" : "18:00",
"dayOfWeek" : [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ],
"opens" : "08:00"
},
"sameAs" : [ "https://www.facebook.com/grantmcgregorltd/", "https://x.com/GrantMcGregorIT", "https://www.youtube.com/itgrantmcgregor", "https://www.linkedin.com/company/grant-mcgregor-ltd/" ],
"telephone" : "+441316037910",
"url" : "https://grantmcgregor.co.uk/"
}
```