Cloud Security for Australian Business: A Practical Guide
Most Australian businesses now run at least part of their operations in the cloud, and for the majority that means Microsoft 365 and Azure. But cloud security is not automatic. The cloud provider secures the infrastructure, but you are responsible for securing everything you put on it. This guide explains what that means in practice.
The shared responsibility model
Cloud security follows a shared responsibility model. Microsoft secures the physical data centres, the network, and the underlying infrastructure. You are responsible for identity, data, access, devices, and configuration. The line depends on the service model.
| Layer | Microsoft secures | You secure |
|---|---|---|
| Physical data centres | Yes | No |
| Network and infrastructure | Yes | No |
| Identity and access | Platform tools | Configuration and policy |
| Data | Encryption at rest | What data lives where and who can access it |
| Devices | No | Endpoint protection and compliance |
| Applications | Platform | Configuration and access |
Identity is your new perimeter
In a cloud environment, identity is your perimeter. There is no firewall to sit behind. If an attacker can log in as one of your users, they are inside. This makes identity the single most important layer of cloud security.
The essentials of identity security in Microsoft 365 and Azure are:
- Multi factor authentication on every account, not just admins
- Conditional Access policies that control where and how users can sign in
- Privileged access management so admin accounts are separate from daily use accounts
- Passwordless authentication (Windows Hello, Authenticator) where possible
- Regular access reviews to remove accounts that no longer need access
Data protection
Cloud data protection is about knowing where your data lives, who can access it, and making sure it is encrypted. In Microsoft 365 and Azure, the key controls are:
- Sensitivity labels to classify and protect documents and emails
- Data loss prevention policies to prevent sensitive information leaving your tenant
- Encryption at rest (enabled by default in Azure and Microsoft 365) and in transit (TLS)
- Customer managed keys in Azure Key Vault for organisations that need to control their own encryption keys
- Backup and retention policies so data is recoverable even if it is deleted or encrypted by ransomware
Endpoint and device security
Cloud means users can work from anywhere, which means devices are your next layer of risk. Every laptop, phone, and tablet that accesses your cloud environment needs to be secured and compliant.
Microsoft Intune is the platform for managing this. It enrolls devices, applies configuration and compliance policies, and can restrict access to cloud resources from non compliant devices. Microsoft Defender for Endpoint adds threat detection and response on top.
Cloud security and the Essential Eight
The Essential Eight maps well to a cloud environment. In fact, most of the controls are easier to implement in the cloud than on premises. ASD has now evolved the Essential Eight into ASD Essentials for enterprise IT, but the core principles remain the same.
| Essential Eight control | In Microsoft 365 and Azure |
|---|---|
| Application control | Windows Defender Application Control via Intune |
| Patch applications | Intune update rings and Microsoft Store for Business |
| Macro settings | Group Policy and Intune configuration profiles |
| User application hardening | Microsoft Edge security baselines via Intune |
| Restrict admin privileges | Entra ID Privileged Identity Management |
| Patch operating systems | Intune update rings for Windows and iOS |
| Multi factor authentication | Entra ID Conditional Access |
| Regular backups | Azure Backup and Microsoft 365 retention policies |
Cloud security and SMB1001
SMB1001 certification is achievable in a cloud environment. In fact, most of the controls are simpler to evidence when your infrastructure is in Microsoft 365 and Azure rather than spread across on premises servers. The assessment looks for the same outcomes regardless of where your systems run.
Common cloud security gaps
Based on our assessments of Australian businesses, the most common cloud security gaps are:
- MFA not enforced on all accounts. MFA on admin accounts is common, but regular user accounts are frequently missed
- No Conditional Access policies. Users can sign in from any device, any location, any network
- Sensitivity labels not deployed. Sensitive documents can be shared externally without restriction
- No access reviews. Accounts for departed staff and contractors remain active
- Backup not tested. Backups exist but restores have never been verified
- Admin accounts used for daily tasks. Admins browse the web and read email from privileged accounts
Getting started
If you are not sure where your cloud security stands, the best starting point is an assessment. Oxana offers a cybersecurity readiness assessment that maps your current Microsoft 365 and Azure environment against the Essential Eight and ASD Essentials, identifies gaps, and produces a prioritised remediation roadmap.
Oxana delivers managed cloud and managed cybersecurity to businesses across Sydney, Melbourne and Brisbane. Get in touch to review your cloud security posture.
Frequently Asked Questions
Is the cloud secure for Australian businesses?
Yes, but security is a shared responsibility. Microsoft secures the physical data centres, network, and infrastructure. You are responsible for identity, data, access, devices, and configuration. The cloud is as secure as you configure it to be.
What is the shared responsibility model in cloud security?
The shared responsibility model defines what the cloud provider secures and what you secure. Microsoft secures the infrastructure (data centres, network, servers). You secure everything you put on it (identity, data, access, devices, configuration). The exact split depends on the service model.
How do I secure Microsoft 365 for my business?
The essentials are: enforce multi factor authentication on all accounts, configure Conditional Access policies, deploy sensitivity labels, set up data loss prevention, manage devices with Intune, and run regular access reviews. Most of this is included in your existing Microsoft 365 licensing.
Does the Essential Eight apply to cloud environments?
Yes. The Essential Eight maps well to cloud environments, and most controls are easier to implement in the cloud than on premises. ASD has now evolved the Essential Eight into ASD Essentials for enterprise IT, but the core principles remain the same.
Can I get SMB1001 certified if my systems are in the cloud?
Yes. SMB1001 certification is achievable in a cloud environment. In fact, most controls are simpler to evidence when your infrastructure is in Microsoft 365 and Azure. The assessment looks for the same outcomes regardless of where your systems run.
What are the most common cloud security gaps?
The most common gaps are: MFA not enforced on all accounts, no Conditional Access policies, sensitivity labels not deployed, no access reviews for departed staff, backups not tested, and admin accounts used for daily tasks like browsing and email.
Oxana security consultants work daily with the Essential Eight, SMB1001 certification and Microsoft security tooling, helping Australian SMBs lift their cyber maturity. Oxana holds SMB1001 certification.