Cloud
Security controls for cloud workloads, configured and checked
Cloud security is the set of identity, network, data and monitoring controls that protect workloads running in hosted or public cloud. Providers secure their infrastructure; securing your accounts, configurations and data is on you. Storcom reviews those controls, closes the gaps, maps them to the framework you report against and can monitor them for you.
Last updated
Practice: Cloud and hybrid cloud
- Built for
- IT and security managers responsible for cloud workloads without a dedicated cloud security engineer
- What you get
- Managed EDR, firewall and exposure management available
- Identity, network, data and logging reviewed
- Mapped to the framework you report to
- Findings ranked by risk, with fixes
- Delivered from
- Geneva, Illinois, for Chicagoland and customers across the U.S.
Who secures what in the cloud?
Every cloud provider works on a shared responsibility model. The provider secures the platform. What you put on it stays yours to secure.
| Layer | Cloud provider | Your organization (with Storcom) |
|---|---|---|
| Data centers, power and hardware | Secures and operates them | Nothing to do |
| Hypervisor and core platform | Patches and maintains it | Nothing to do |
| Network rules and VPNs | Supplies the firewall and VPN tools | Configures, reviews and monitors them |
| Operating systems and applications | Covers them only for fully managed platform services | Patches and hardens every VM you run |
| Identities and access | Supplies the identity service | Sets MFA, roles, least privilege and access reviews |
| Data, keys and backups | Offers encryption and storage features | Decides what is encrypted, retained and recoverable |
The exact split varies by service. Platform and software services shift more of the stack to the provider than virtual machines do.
Controls we review in every cloud environment
- Endpoint detection and response on cloud servers, not just laptops
- Multi-factor authentication on every administrative account, with no shared logins
- Role-based access with least privilege, reviewed on a schedule
- No management ports such as RDP or SSH open to the internet
- Segmentation and firewall rules between application tiers and back to your sites
- Encryption at rest and in transit, with clear ownership of the keys
- Operating system and application patching on every virtual machine
- Centralized logging and alerting that someone actually reviews
- Backups stored outside the production account, with an immutable copy
- Regular vulnerability scanning of internet-facing systems
How does Storcom help with cloud compliance?
Frameworks such as HIPAA, PCI DSS and CJIS don’t change because a workload moved to the cloud. What changes is where the controls live and where the evidence comes from. We review your cloud controls against the framework you report to, document the gaps in plain language and help you close them.
Two things to keep straight. Your cloud provider publishes its own audit reports for its infrastructure, which your auditor can request from them. Storcom does not issue attestations on your behalf; we help you put the controls and documentation in place for your own assessment. Our system compliance page covers how we approach this.
Ongoing protection for cloud workloads
For teams without a full-time security headcount, these services keep the controls working after the review is done.
Managed EDR
Endpoint detection and response, such as CrowdStrike Falcon, on cloud servers, with alerts triaged and acted on for you.
Managed firewall
Firewall rules, VPNs and segmentation for hosted and hybrid networks, maintained and reviewed by Storcom.
Continuous risk scanning
Ongoing exposure assessment through CrowdStrike Falcon, so a new exposure such as a port opened during a change is caught early.
Incident response planning
A written plan for a cloud incident: who decides, who to call, how to isolate a workload and how to recover it.
Technology we deploy for this
CrowdStrike Falcon for endpoint detection and response and vulnerability management, resold, deployed and tuned by Storcom, including Falcon Flex bundles.
Microsoft Azure infrastructure and Microsoft 365, with Storcom managing Azure resources and backing up Exchange Online, SharePoint, OneDrive and Teams.
Amazon Web Services infrastructure for workloads that belong in public cloud, sized, migrated and managed by Storcom.
Frequently asked questions
Isn’t security the cloud provider’s job?
Partly. Providers secure the physical data centers, hardware and core platform. Your accounts, access policies, network rules, operating systems and data remain your responsibility, and stolen credentials and misconfigured settings are common ways in.
Does Storcom hold compliance certifications that cover our cloud?
No. Compliance attestations belong to the organization being assessed. Your cloud provider has its own audit reports for its infrastructure, and your organization is assessed on its own controls. Storcom helps you design, document and evidence those controls.
Which compliance frameworks can you help with?
Storcom works from the framework you answer to, such as HIPAA for patient data, PCI DSS for card payments or CJIS for criminal justice information. We map your cloud controls to its requirements, identify gaps and help you produce the documentation your auditor will ask for.
Can you secure workloads in both Azure and AWS?
Yes. The controls are the same in principle (identity, network rules, encryption, logging, patching and backup) even though each provider configures them differently. Storcom reviews each environment against the same baseline, so you get one consistent picture.
Where do we start with a cloud security review?
With a discovery call. We talk through your cloud accounts, who has access and what worries you, then scope the work. Where exposure assessment is the right next step, it is delivered through CrowdStrike Falcon.
Related services
- Security OverviewManaged security services from Storcom: managed EDR, continuous risk scanning, managed firewall and…
- Compliance support
- Managed EDRManaged EDR from Storcom: 24×7 endpoint detection and response on CrowdStrike Falcon or Arctic Wolf, with…
- Managed FirewallManaged firewall services from Storcom: policy management, firmware updates, monitoring and change control for…
- Continuous Risk ScanningContinuous risk scanning, delivered by Storcom on CrowdStrike Falcon, finds and ranks vulnerabilities across…
- Public cloudAzure, AWS and IBM Cloud design, migration and cost governance for IT teams of every size.
Start with a discovery call.
Tell us what you run today, what is changing and what worries you. We listen, ask questions and tell you plainly whether and how we can help. No cost, no commitment.