Securing hybrid and multi-cloud: responsibility, identity, posture

Most organisations now run a mix of on-premises systems, one or more public clouds and SaaS applications. The security problem is rarely a flaw in the cloud platform itself. It is a misconfigured storage bucket, an over-privileged account, an exposed management port or a log nobody collects. Hybrid and multi-cloud environments multiply these risks because every platform has its own console, vocabulary and defaults, and responsibility is easily assumed to sit with someone else.

Understand the shared responsibility model

The provider secures the underlying facilities, hardware and core services. You remain responsible for your identities, data, configuration, network rules and, depending on the service, the operating system and applications. The split shifts between infrastructure, platform and software services, so document it for each service you use. Write down, per workload, who owns patching, backup, logging, encryption keys and incident response, and confirm it in contracts and runbooks.

Identity is the new perimeter

In the cloud, a stolen credential is often more dangerous than a network breach.

• Federate cloud access to one corporate identity provider and enforce MFA, with stronger methods for administrators.
• Apply least privilege and time-bound elevation for administrative roles; avoid standing global administrators.
• Replace long-lived access keys with short-lived credentials and managed identities for workloads.
• Protect break-glass accounts, store their credentials securely and alert on any use.
• Review entitlements regularly, including service accounts and third-party integrations.

Posture, logging and guardrails

Cloud security posture management (CSPM) tools continuously compare your environments with a baseline such as the CIS Benchmarks and report drift, public exposure and risky settings across providers in one view. They help most when findings are triaged by risk and routed to the team that owns the resource.

• Logging: enable control-plane and audit logs in every account and subscription, send them to a central, protected location and into your SIEM, and retain them according to policy.
• Infrastructure as code (IaC): define environments in version-controlled templates, scan them for misconfigurations before deployment and use policy-as-code guardrails so that insecure resources cannot be created at all.
• Account structure: separate production, non-production and security tooling into distinct accounts or subscriptions, with organisation-wide baseline policies.
• Encryption: encrypt data at rest and in transit, and decide deliberately who controls the keys.

Data residency and connectivity

Know where your data is stored and processed, and choose regions in line with your sector rules, contractual commitments and internal classification policy. Confirm where backups, logs and support access are located, as these are often forgotten. Do not assume a specific national rule applies or does not apply; obtain legal and regulatory advice for your own situation.

For connectivity, site-to-site IPsec VPN is quick to deploy and suitable for modest or backup needs. Dedicated private links, where available, offer more predictable performance and keep traffic off the public internet, but they still need encryption decisions, segmentation and monitoring. Terminate connections in a controlled network zone with firewall inspection, use private endpoints for platform services and avoid exposing management interfaces publicly. Design redundancy from the start, since a single link is a single point of failure.

How Wethaq ICT helps

Wethaq ICT helps organisations assess hybrid and multi-cloud environments, design secure account structures and connectivity, strengthen identity controls, deploy posture and log monitoring, and operate these controls through managed services. We keep guidance vendor-neutral and aligned with frameworks such as NIST CSF 2.0 and ISO/IEC 27001.