Cloud security for North Carolina small businesses requires understanding that moving to the cloud does not automatically make your data secure. The shared responsibility model means that while cloud providers secure the infrastructure, your business is responsible for securing your data, identities, configurations, and access controls. Cloud misconfiguration is now the leading cause of cloud security incidents.
Key takeaway: According to CSA's 2024 Top Threats Report, misconfiguration is the number one cloud threat, with 31% of all cloud breaches stemming from configuration errors. Gartner projects that through 2025, 99% of cloud security failures will be the customer's fault, primarily due to misconfigurations and inadequate security practices.
Need help securing your cloud environment? Preferred Data Corporation provides cybersecurity, cloud solutions, and managed IT for North Carolina businesses. BBB A+ rated with 37+ years of experience. Call (336) 886-3282 or schedule your cloud security assessment.
Understanding the Shared Responsibility Model
The shared responsibility model defines who secures what in cloud computing. For Piedmont Triad, Charlotte, and Raleigh businesses using Microsoft 365, Azure, AWS, or Google Cloud, this understanding is fundamental.
What the Cloud Provider Secures
Microsoft, Amazon, and Google secure:
- Physical data center security (buildings, power, cooling)
- Network infrastructure (global backbone, DDoS protection)
- Hypervisor and host operating systems
- Storage hardware and replication
- Platform availability and uptime guarantees
What Your Business Must Secure
Regardless of cloud provider, you are responsible for:
- Identity and access management (who can access what)
- Data classification and protection (encryption, DLP)
- Application configuration (security settings, permissions)
- Network controls (firewalls, segmentation, VPN)
- Endpoint security (devices accessing cloud services)
- Compliance (meeting regulatory requirements for your industry)
- Monitoring and response (detecting and responding to threats)
The Critical Gap
Research shows that 83% of organizations dealt with at least one cloud security incident in 2024, and 82% of cloud breaches stem from human error rather than sophisticated attacks. The gap between "we moved to the cloud" and "our cloud is secure" is where most NC businesses are vulnerable.
Identity Security: Your First Line of Defense
Identity is the new perimeter. When your applications are in the cloud, controlling who can access them from where becomes your primary security control.
Multi-Factor Authentication (MFA)
MFA is non-negotiable for every cloud service. For High Point, Greensboro, and Winston-Salem businesses:
Implement MFA everywhere:
- All Microsoft 365 and Google Workspace accounts
- VPN and remote access connections
- Cloud administration consoles (Azure, AWS, GCP)
- Financial applications and banking portals
- Any system accessible from the internet
MFA best practices:
- Use authenticator apps (Microsoft Authenticator, Google Authenticator) over SMS
- Require hardware security keys (YubiKey, FIDO2) for administrators
- Enable number matching to prevent MFA fatigue attacks
- Block legacy authentication protocols that bypass MFA
- Monitor and investigate MFA denial events
Single Sign-On (SSO)
Centralize authentication through one identity provider:
- Fewer passwords to manage and potentially compromise
- Instant access revocation when employees depart
- Consistent security policies across all applications
- Better visibility into access patterns
- Simplified compliance auditing
Conditional Access Policies
Apply intelligent access controls based on context:
- Location-based: Block access from countries where you have no business
- Device-based: Require managed, compliant devices for sensitive data
- Risk-based: Require additional verification for suspicious sign-in patterns
- Application-based: Different requirements for email vs. financial systems
- Session-based: Time-limited access for sensitive operations
Encryption: Protecting Data at Rest and in Transit
Encryption ensures data remains protected even if access controls fail.
Data in Transit
- TLS 1.2 or 1.3 for all web traffic and API connections
- VPN or private connectivity for sensitive data transfers
- Email encryption for messages containing personal or financial information
- SFTP or encrypted channels for file transfers to partners
Data at Rest
- Cloud-native encryption enabled on all storage (Azure Storage Service Encryption, S3 default encryption)
- Customer-managed keys for sensitive data requiring key control
- Database encryption (Transparent Data Encryption for SQL databases)
- Backup encryption with keys stored separately from backup data
Endpoint Encryption
For devices accessing cloud services from NC offices and remote locations:
- BitLocker (Windows) or FileVault (Mac) on all company devices
- Mobile device encryption enforced through MDM policies
- USB and removable media encryption when allowed at all
- Remote wipe capability for lost or stolen devices
Configuration Management and Cloud Security Posture
Organizations average 43 misconfigurations per cloud account and 32% of cloud assets sit unmonitored. Proper configuration is essential.
Microsoft 365 Security Configuration
For NC businesses using Microsoft 365 (the majority):
Email security:
- Enable Advanced Threat Protection (ATP) for malicious attachments and links
- Configure anti-phishing policies with impersonation protection
- Enable Safe Links and Safe Attachments
- Implement DKIM, SPF, and DMARC for email authentication
- Block automatic forwarding to external domains
SharePoint and OneDrive:
- Restrict external sharing to approved domains
- Enable DLP policies for sensitive content (SSN, credit cards)
- Configure access expiration for shared links
- Audit file access and sharing activities
- Implement sensitivity labels for document classification
Teams and collaboration:
- Restrict guest access to authorized external domains
- Disable anonymous meeting join for sensitive meetings
- Configure data loss prevention in chat and channels
- Review third-party app permissions regularly
- Audit Teams activity logs
Cloud Infrastructure Security (Azure/AWS)
For businesses with cloud infrastructure beyond SaaS:
- Network security groups restricting traffic to necessary ports
- No public access to databases, storage, or management interfaces
- Logging enabled on all resources (activity logs, diagnostic logs)
- Unused resources removed to reduce attack surface
- Resource locks preventing accidental deletion of critical resources
- Tagging standards for identifying resource ownership and purpose
Worried about your cloud configuration? PDC provides cloud security assessments and ongoing cloud management for North Carolina businesses. Call (336) 886-3282 or visit pdcsoftware.com/contact.
Logging, Monitoring, and Detection
You cannot protect what you cannot see. Continuous monitoring detects threats before they become breaches.
Essential Logs to Collect
- Sign-in logs: All authentication attempts (success and failure)
- Audit logs: Administrative changes to configurations and permissions
- Email logs: Delivery, forwarding, and rule creation activities
- File activity: Access, sharing, and download events for sensitive content
- Cloud infrastructure: Resource creation, modification, and access events
Alert Conditions to Monitor
Set alerts for suspicious activities:
- Multiple failed login attempts from unusual locations
- Login from impossible travel scenarios (two locations simultaneously)
- Administrative privilege escalation
- Mass file downloads or sharing events
- Email forwarding rules created by non-administrators
- New devices accessing sensitive applications
- Changes to security configurations
Security Information and Event Management (SIEM)
For Raleigh, Charlotte, and Piedmont Triad businesses with elevated security needs:
- Centralized log collection from all cloud and on-premises sources
- Correlation of events across multiple systems
- Automated threat detection using behavioral analytics
- Incident investigation with full audit trail
- Compliance reporting for regulatory requirements
Continuous Compliance Management
Moving to the cloud does not eliminate compliance obligations for NC businesses.
Compliance Frameworks and Cloud
- HIPAA: Healthcare data in the cloud requires BAAs, access controls, and audit logs
- PCI DSS: Payment data processing in cloud requires network segmentation and encryption
- CMMC: Defense data in cloud requires specific security configurations
- NC GS 75-65: Breach notification applies regardless of where data is stored
Cloud Security Posture Management (CSPM)
Automated tools that continuously assess cloud configurations:
- Scan for misconfigurations against security benchmarks (CIS, NIST)
- Alert on configuration drift from approved baselines
- Prioritize remediation by risk severity
- Generate compliance reports for auditors
- Track remediation progress over time
CISA issued Binding Operational Directive 25-01 in December 2024 mandating federal agencies secure cloud environments, setting a standard that private sector organizations should also follow.
Cloud Security Checklist for NC Small Businesses
Use this checklist to assess your cloud security posture:
Identity and Access (Critical)
- [ ] MFA enabled for all users (no exceptions)
- [ ] Legacy authentication protocols blocked
- [ ] Conditional access policies configured
- [ ] Administrative accounts limited and monitored
- [ ] Regular access reviews conducted (quarterly minimum)
- [ ] Offboarding process includes immediate cloud access revocation
Data Protection
- [ ] Encryption enabled for all data at rest
- [ ] TLS enforced for all data in transit
- [ ] Data loss prevention (DLP) policies active
- [ ] Sensitivity labels applied to classified documents
- [ ] External sharing restricted to approved domains
- [ ] Backup encryption with tested restoration
Configuration
- [ ] Security baselines applied (CIS benchmarks)
- [ ] Unnecessary features and ports disabled
- [ ] Regular configuration reviews (monthly)
- [ ] Change management process for security settings
- [ ] Third-party app permissions reviewed and restricted
- [ ] Unused licenses and accounts deactivated
Monitoring
- [ ] Sign-in and audit logs retained (90+ days)
- [ ] Alert rules configured for suspicious activities
- [ ] Regular log review process established
- [ ] Incident response procedures documented
- [ ] Security dashboard accessible to IT management
Compliance
- [ ] Regulatory requirements mapped to cloud controls
- [ ] Data residency requirements verified
- [ ] Third-party risk assessments completed
- [ ] Annual security assessments performed
- [ ] Employee security training includes cloud-specific topics
Common Cloud Security Mistakes NC Businesses Make
Assuming the Provider Handles Security
The most dangerous misconception. 45% of data breaches occur in the cloud, and 80% of security exposures are found in cloud environments versus on-premises. Moving to the cloud without implementing your portion of the shared responsibility model creates more risk, not less.
Using Default Configurations
Cloud services deploy with usability-focused defaults that prioritize convenience over security. Default settings often include:
- External sharing enabled for all users
- Legacy authentication allowed
- Minimal logging and alerting
- Broad administrative privileges
- No conditional access restrictions
Neglecting Regular Reviews
Cloud environments change constantly as users create resources, modify settings, and add applications. Without regular reviews, configuration drift accumulates. Schedule monthly security configuration reviews and quarterly access audits.
Ignoring Shadow IT
Employees adopting unauthorized cloud services create unmonitored risk. For Durham, Raleigh, and Charlotte businesses, shadow IT can include:
- Personal Dropbox/Google Drive for work files
- Unauthorized project management tools
- Consumer-grade communication apps
- Free-tier SaaS applications with inadequate security
Implement cloud access security brokers (CASB) or Microsoft Defender for Cloud Apps to discover and govern shadow IT usage.
Why NC Businesses Trust PDC for Cloud Security
Preferred Data Corporation has secured North Carolina business technology since 1987, providing cybersecurity, cloud solutions, and managed IT from our High Point headquarters.
PDC's cloud security services:
- Cloud security assessments evaluating configuration against industry benchmarks
- Microsoft 365 hardening implementing security best practices
- Identity and access management with MFA, SSO, and conditional access
- Continuous monitoring detecting threats across cloud and on-premises
- Compliance support for HIPAA, PCI DSS, CMMC, and NC regulations
- Incident response for cloud-based security events
- On-site within 200 miles of High Point for hands-on support
- BBB A+ rated with 20+ year average client retention
Ready to secure your cloud environment? Contact Preferred Data Corporation for a free cloud security assessment. Call (336) 886-3282 or visit pdcsoftware.com/contact.
Frequently Asked Questions
Is the cloud less secure than on-premises?
Neither is inherently more or less secure. Cloud providers invest billions in physical and infrastructure security that most small businesses cannot match. However, 80% of cloud security exposures come from customer misconfigurations, not provider failures. A properly configured cloud environment is typically more secure than a poorly managed on-premises setup, but the configuration responsibility falls on you.
What is the most important cloud security control for small businesses?
Multi-factor authentication (MFA) provides the highest security impact per dollar invested. MFA prevents the majority of credential-based attacks, which represent the most common initial access vector for cloud breaches. Implement MFA for all users on all cloud services as your first priority, then layer additional controls like conditional access and DLP policies.
How do we know if our cloud configuration is secure?
Engage a security assessment against established benchmarks such as CIS (Center for Internet Security) controls or Microsoft Secure Score. These provide specific, measurable security settings with pass/fail evaluations. Most NC small businesses score 40-60% on initial assessments, with achievable paths to 80%+ through proper configuration and ongoing management.
Does cloud security require different insurance than traditional IT?
Most modern cyber insurance policies cover cloud-hosted data alongside on-premises systems. However, insurers increasingly require specific cloud security controls (MFA, encryption, backup, configuration management) as policy conditions. Review your cyber insurance requirements with your carrier and ensure your cloud security implementation satisfies their conditions to avoid claim denials.
How much does cloud security cost for a small business?
For a 25-50 employee NC business, cloud security costs include: Microsoft 365 E3/E5 licensing with security features ($36-$57/user/month), managed security monitoring ($500-$2,000/month), annual security assessments ($5,000-$15,000), and employee training ($2,000-$5,000/year). Total investment ranges from $30,000-$75,000 annually, significantly less than the average breach cost of $2.98-$3.31 million for SMBs.