Most cloud breaches do not begin with a sophisticated exploit. They begin with a setting — a storage bucket left open, an over-permissive role, a database exposed to the internet “just for testing.” As organisations across East Africa move to AWS, Azure, and Google Cloud, the misconfiguration has quietly become the most common way sensitive data ends up somewhere it should not be.
Why misconfigurations are so common
The cloud rewards speed. A developer can stand up new infrastructure in minutes, and that same speed makes it easy to leave a door open. Default settings are not always the safe settings, permissions tend to accumulate rather than shrink, and environments that grew organically are rarely reviewed as a whole. Nobody decided to expose the data — it happened one reasonable shortcut at a time.
The usual suspects
Across our cloud audits, a handful of issues account for the majority of serious findings:
- Public storage buckets. Object storage set to public — or shared with a link that never expires — remains the classic cloud data leak.
- Over-permissive identities. Roles and access keys granted far more than they need, so a single compromised credential unlocks the whole account.
- Exposed management surfaces. Databases, dashboards, and admin panels reachable from the open internet instead of a private network.
- Missing logging. When something does go wrong, the absence of audit logs turns a contained incident into a guessing game.
A practical way to reduce the risk
Start from least privilege
Grant each identity only what it needs, and review permissions on a schedule. It is far easier to add access when someone genuinely needs it than to claw back access that was never used.
Benchmark against a known standard
The CIS Benchmarks give you a concrete, vendor-published checklist for AWS, Azure, and GCP. Measuring your environment against them turns “are we secure?” into a specific list you can work through.
Make logging non-negotiable
Turn on account-level audit logging and store it somewhere the same credentials cannot delete. You cannot investigate what you did not record.
Review the whole, not just the new
Point-in-time reviews of a fast-moving environment go stale quickly. A periodic configuration audit catches the drift that day-to-day changes introduce.
Worth remembering: in the cloud, the provider secures the platform — but you are responsible for how you configure it. That shared-responsibility line is where most breaches happen.
Getting a clear picture
If your cloud footprint has grown faster than your security review, a configuration audit is the fastest way to see where you actually stand. We benchmark your environment against CIS controls and hand you a prioritised, plain-language list of what to fix first. See how our cloud security audits work, or get in touch for a scoping conversation.
