Cloud security
Configuration is the attack surface now
Most cloud incidents do not start with a clever exploit. They start with a setting. A storage bucket left open to the internet, an identity role with far more permission than the job needs, a database reachable from any IP address, logging switched off on the one service nobody watches. The cloud provider did nothing wrong. The customer configured it that way.
Cloud Security Posture Management, usually shortened to CSPM, exists for exactly this problem. It is the practice of continuously checking how your cloud is configured, comparing that against security baselines, and fixing what is wrong before somebody else finds it. This page explains what CSPM is, what it catches, how it works across AWS, Azure and Google Cloud, what it does for compliance in the UAE, and what it actually takes to run.
Definition
What CSPM actually does
A CSPM platform connects to your cloud accounts through the provider's own APIs and reads how every resource is set up. It builds an inventory, tests each item against security benchmarks such as the CIS Benchmarks or NIST guidance, and reports what drifts away from the baseline. It then keeps doing that, around the clock, because your engineers keep changing things.
- Discovers every resource, including the ones nobody remembered creating
- Flags settings that break a security or compliance rule
- Ranks findings by real risk, not by alphabetical order
- Guides or automates the fix, then verifies it stayed fixed
This sits squarely on your side of the shared responsibility model. AWS, Microsoft and Google secure the infrastructure underneath. Configuring the services on top of it is the customer's job, and that is the part CSPM measures.
The misconfigurations attackers look for first
Storage open to the world
Object storage set to public, or shared with a link that never expires. Automated scanners find these within hours of creation.
Over-permissive identities
A service account given administrator rights because it was quicker than working out the four permissions it really needed.
Security groups left wide open
Inbound rules allowing 0.0.0.0/0 on management ports, usually added during a late-night troubleshooting session and never removed.
Data left unencrypted
Volumes, snapshots and database backups created without encryption at rest, or with keys that nobody rotates.
Logging and monitoring disabled
Audit trails switched off to save cost. When something does go wrong, there is no record of what the intruder touched.
Forgotten test resources
A proof of concept spun up for a two-week trial, still running two years later with an old image and a default password.
How one wrong setting becomes a breach
The opening
A developer publishes an internal reporting app to a public subnet for a client demo. The security group allows traffic from anywhere. The demo ends, the rule stays.
The pivot
Internet-wide scanners find the exposed host in a matter of hours. The app runs under a role with broad read access to storage, because that was easier during development.
The damage
Using that role, an attacker reads the customer database exports sitting in storage. Audit logging was never enabled on the bucket, so nobody can say what was copied or when.
How CSPM works: four phases running non-stop
Discover
The tool reads every account, region and subscription and builds a live inventory of compute, storage, databases, identities, networks and serverless functions.
Assess
Each resource is tested against benchmarks and policy packs: CIS, NIST, ISO 27001 controls, plus any internal rules your business adds.
Prioritise
Findings are scored on context: is the resource internet-facing, does it hold sensitive data, does it chain with another finding into a viable attack path.
Remediate
Guided fixes, ticket handoffs to the owning team, or automated correction for low-risk classes such as re-enabling encryption defaults.
CSPM benefits a business feels in the first quarter
One honest view of the estate
Multi-cloud, multi-account, multi-region, all in a single inventory. Most teams find resources they did not know existed in the first week.
Misconfigurations caught in hours, not audits
A change that breaks a baseline is flagged when it happens, instead of surfacing at the next annual review, if it surfaces at all.
Less alert noise
Context-based scoring pushes the exposed, sensitive, reachable findings to the top so a small team can work a list that is short enough to finish.
Audit evidence on demand
Control-by-control reporting replaces the scramble of screenshotting console settings the week before an assessment.
Engineers stop guessing
Findings arrive with the exact resource, the exact rule and the exact fix, so a developer can close one in minutes rather than opening a debate.
Cheaper than the incident
Posture work is planned, budgeted and boring. Breach response is none of those things, and it lands on top of everything else the team was doing that month.
CSPM across AWS, Azure, Google Cloud and Huawei Cloud
Every provider names things differently. An S3 bucket policy, a storage account access tier and a Cloud Storage IAM binding are three vocabularies for the same mistake. CSPM normalises them, so one rule such as "no public object storage anywhere" is enforced once and checked everywhere.
Each platform also ships posture features of its own, and a sensible design uses them rather than replacing them. Those native signals usually sit alongside the wider security stack a business already runs, from Microsoft 365 threat protection to Sophos and Barracuda, and CSPM is the layer that tells you whether the cloud underneath them is configured the way you think it is.
AWS
Security Hub aggregates findings, Config tracks configuration drift, GuardDuty adds threat detection, and CIS AWS Foundations Benchmark provides the baseline most teams start from.
Microsoft Azure
Defender for Cloud carries the posture score and recommendations, while Azure Policy pushes guardrails down so non-compliant resources are blocked at creation.
Google Cloud and Huawei Cloud
Security Command Center covers discovery and misconfiguration findings on Google Cloud, and the same posture rules extend to Huawei Cloud estates through a third-party CSPM layer.
Compliance
What CSPM hands your auditor in the UAE
Global CSPM guides talk about GDPR and HIPAA. UAE businesses answer to a different set of authorities, and posture evidence is what most of those assessments come down to: who could access this data, was it encrypted, where did it physically sit, and can you prove it.
The frameworks below matter most to Dubai and Abu Dhabi organisations, and it is worth reading them next to the wider set of cybersecurity frameworks every UAE business should know.
- UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021
- NESA / UAE Information Assurance Standards
- DESC Information Security Regulation for Dubai government-linked entities
- ADHICS for healthcare data in Abu Dhabi
- ISO 27001 control evidence
- CIS Benchmarks per cloud platform
- NIST SP 800-53 control mapping
- PCI DSS for card data environments
- Encryption at rest and in transit proof
- Least-privilege identity evidence
- Audit logging enabled and retained
- Region pinning for data residency
Region pinning is the one that catches people out. A workload can drift into a foreign region through a default setting in a deployment template, which is a posture problem long before it becomes a legal one. If that is a live question for your business, the guide to data localization and privacy laws in the UAE covers the obligations in detail.
CSPM, CWPP, CIEM, DSPM and CNAPP: who covers what
| Question it answers | CSPM | CWPP | CIEM | DSPM |
|---|---|---|---|---|
| Is this cloud resource configured safely? | ✓ | , | , | , |
| Is the workload inside the VM or container compromised? | , | ✓ | , | , |
| Who has permissions they should not have? | Partly | , | ✓ | , |
| Where is my sensitive data and who can reach it? | , | , | , | ✓ |
| Am I compliant with a named framework? | ✓ | , | Partly | Partly |
CNAPP is the umbrella. It bundles these capabilities into one platform, with CSPM as the governance layer underneath. Buying a CNAPP without doing the posture work first means paying for context you are not yet able to act on.
Rolling CSPM out without stalling delivery
-
Week 1
Connect and observe
Read-only access to every account. No enforcement, no blocking. The goal is an inventory and a first, uncomfortable, honest baseline.
-
Week 2
Agree the rules that matter
Pick the benchmark, switch on the frameworks you are actually assessed against, and mute the checks that do not apply to your architecture.
-
Week 3
Fix the exposed and the privileged
Internet-facing plus over-permissioned plus sensitive data is the intersection worth clearing first. Everything else waits.
-
Week 4
Push checks left and automate
Scan templates in the pipeline so bad configuration never ships, and auto-remediate the low-risk classes. Posture becomes a habit, not a project.
A rollout is far smoother when posture rules are agreed before workloads land, which is why this conversation belongs inside a cloud migration plan rather than six months after it.
When a company actually needs CSPM
- One small workload, one account, one person who deploys it.
- Nothing sensitive stored, no regulated data, no audit obligation.
- Infrastructure changes a few times a year, not a few times a day.
- Native provider recommendations are already being read and acted on.
- More than one cloud account, subscription or provider.
- Customer, patient, student or payment data in the cloud.
- An audit, tender or client security questionnaire in the next year.
- Developers or vendors who can provision resources without review.
- Nobody can currently answer "is anything of ours public right now" in under an hour.
Cost, setup time and false alerts
Cost
Pricing normally scales with the number of cloud resources or workloads under watch, so a small estate pays a small amount. Native posture features on AWS and Azure cover the basics at a lower entry point, and a third-party platform earns its place once you have several accounts, several providers, or an audit to satisfy. Start with what the provider already gives you and add on when the estate outgrows it.
Setup time
Connecting accounts and getting first findings is a same-week exercise, because it is API access rather than agent deployment. The real work is the month after: deciding which findings you accept, which you fix, and who owns each one. Teams that skip that step end up with an expensive dashboard nobody opens.
False alerts
Noise is the reason posture projects die. It is manageable: tune the ruleset to your architecture, mark accepted risks with an expiry date so exceptions do not become permanent, and let the platform auto-close the trivial classes. A finding list that a team can genuinely clear each week beats a perfect list that nobody touches.
Practice
Best practices worth stealing
None of these need a bigger budget. They need somebody to own the outcome and a weekly hour to look at the list.
- Pick one benchmark and stick to it
- Fix internet-facing findings first
- Give every finding an owner
- Time-box every accepted exception
- Scan infrastructure code before deploy
- Auto-remediate the boring classes
- Alert on new public exposure instantly
- Enforce encryption by policy, not by memory
- Review identity permissions quarterly
- Keep audit logging on everywhere
- Pin regions for data residency
- Report posture to management monthly
CSPM questions UAE businesses ask
What is the main benefit of CSPM?
Knowing, continuously and without asking anyone, whether your cloud is configured the way you believe it is. Everything else that CSPM benefits lists mention, fewer misconfigurations, less alert noise, faster audits, cheaper incidents, follows from that one thing: visibility you can trust on a Tuesday afternoon, not just on the day of an assessment.
Is CSPM the same as a cloud security assessment?
No. An assessment is a snapshot: it tells you what was wrong on the day someone looked. CSPM is the standing capability that watches for the next wrong thing. Most businesses do both, an assessment to get a baseline and a remediation plan, then posture management to hold the line as engineers keep shipping.
Does CSPM work with Microsoft 365 as well as Azure?
Classic CSPM targets infrastructure services in IaaS and PaaS. Configuration risk in SaaS platforms such as Microsoft 365, for example sharing settings, guest access and admin roles, is handled by SaaS posture tooling and by the platform's own secure score. The two overlap in practice, and any serious review of a Microsoft estate should cover both.
Can CSPM automatically fix problems, or does it only report them?
Both, and the choice is yours per rule. Automated remediation is safe and sensible for narrow, low-risk classes such as re-enabling encryption defaults or closing a newly opened public bucket. For anything that could break a production service, most teams prefer a ticket to the owning engineer with the exact fix attached.
Does CSPM help with the UAE Personal Data Protection Law?
It provides the technical evidence layer. PDPL, NESA and DESC assessments ask whether personal data is encrypted, whether access is limited to those who need it, whether activity is logged, and where the data physically resides. CSPM checks and records exactly those states across every account, which turns a fortnight of manual evidence collection into a report you can export.
Which cloud platforms does CSPM cover?
The major public clouds, with AWS, Microsoft Azure and Google Cloud being the best supported. Huawei Cloud and other providers are covered through platform-specific integrations. This matters for UAE businesses in particular, because mixed estates are the norm here rather than the exception, and a rule that only holds on one provider is not really a rule.
We are a 40-person company. Is this overkill for us?
Attackers scan by IP range, not by company size. If you hold customer or patient data in the cloud and more than one person can create resources, posture management is proportionate. Start with the native tooling in your existing subscriptions and a defined weekly review, and only move to a dedicated platform when the estate or the audit load justifies it.
Want a second pair of eyes on your cloud posture?
Rounak Computers has been running cloud and security work for UAE businesses from Bur Dubai since 2004, as a Gold partner of Microsoft, Huawei and Amazon. If you would rather hand the weekly finding list to someone else, our managed IT services team already does this for corporates and SMEs across Dubai and Abu Dhabi.
