Now we will turn to governance and creating an application security baseline. Apart from the topics covered so far, this is more application-specific. A public-facing e-commerce app has different considerations than an internal application within a financial institution or bank. One is restricted to a specific user and their own information whereas the other will allow multiple users different levels of access to other people's sensitive information.

To evaluate an application's security baseline, we need to do an initial task assessment to identify your core business risks related to cloud security, translate those business risks into specific technical risk profiles. Before deployment, perform a review to identify any new risks and make sure all access and data security policy requirements are met. As part of the deployment process, validate security policy compliance. Regularly perform audits on cloud deployments to ensure their continued alignment with security policy.

For auditing and subsequent adherence to security policy to work, you must be monitoring application performance and collecting security data and metrics. Ensure that automated monitoring is enabled, and data and logs are being collected and securely stored. When something goes wrong, there must be a clear path and procedure to report incidents and take action. You should have lines in the sand that trigger a security response. For example, if increased brute force or denial of service attacks are detected, say at 25%, then a plan must be in place to prevent further escalation. If unclassified data is detected, then external access should be denied until the data owner can apply the appropriate classification. If a security health issue is detected, disable access to any virtual machines that have known access or malware vulnerability identified until appropriate patches of security software can be installed. Update policy guidance to account for any newly detected threats. If a network vulnerability is detected, access to any resource not explicitly allowed by the network access policy should be triggered to alert IT security and staff and the relevant workload owner. Track issues and update guidance if policy revision is necessary to mitigate future incidents.