Cloud Security Basics: Who Holds the Keys to Your Kingdom?
Quick question: who in your office knows the password to your main business email? Now, who else knows it? Did your previous IT guy, the one who left in 2023, ever change it? Is it written down somewhere? Is that somewhere a sticky note on the receptionist's monitor? Then it is a good moment to talk about cloud security for businesses in Kenya.
If you hesitated at any of those questions, this article is for you. Moving to the cloud makes your business more flexible and often more secure, but only if you look after the keys. The cloud provider guards the building. You are responsible for who gets a key to your room.
The shared responsibility idea
Cloud providers invest heavily in protecting their data centres, networks and hardware. They are generally far better at it than a server in your back office. But they cannot stop someone logging in with your password. If an attacker has your username and password, the system sees them as you.
That is why most cloud security problems in small businesses are not dramatic hacks. They are ordinary things: weak passwords, shared accounts, former staff who still have access and people clicking links in convincing fake emails.
Cloud security for businesses: the basics that stop most problems
You do not need a security department to dramatically reduce your risk. Start with these:
Turn on two-factor authentication for email, banking, accounting and anything else important
Give every person their own account instead of sharing one login
Use a password manager so people can have strong, unique passwords without writing them down
Remove access the same day someone leaves the company
Give people only the access their job needs, not admin rights for everyone
Keep devices updated, including phones used for work
Two-factor authentication deserves special mention. It means that even if someone steals your password, they also need a code from your phone. It is a small inconvenience that blocks a huge share of account break-ins. If you do only one thing after reading this, do that.
Watch out for the friendly email
Many attacks begin with an email or WhatsApp message that looks real. A supplier "kindly" asking you to update their bank details. A message claiming to be from your email provider saying your mailbox is full. A link to view an "urgent invoice". Mutua in accounts once nearly paid a fake invoice that looked exactly like one from a real supplier, down to the logo. He only stopped because the bank details were different and he called the supplier to check.
Build a simple rule into your business: any request to change payment details must be confirmed by a phone call to a number you already have, never one provided in the same email.
Who owns the master keys?
Every cloud service has an owner or administrator account with full control. Think carefully about who holds it.
The owner account should belong to the business, using a company email address
At least two trusted people should have admin access, so you are not stuck if one is unavailable
Recovery phone numbers and emails should be current and controlled by the business
Admin access should be reviewed every few months
Developers and outside contractors should have their own accounts, removed when the work ends
Personal data comes with responsibility
If your business stores information about customers, patients, students or staff, Kenya's Data Protection Act 2019 applies. Among other things, it expects organisations to take reasonable steps to keep personal data secure. Good access control, strong authentication and knowing where your data lives are not just good habits. They are part of meeting your obligations.
A small checklist for this week
Pick one hour this week and do the following: list your important cloud accounts, check who has access to each, turn on two-factor authentication everywhere you can, and remove anyone who no longer needs access. Then take that sticky note off the monitor. Shred it. Do not, under any circumstances, replace it with a new sticky note under the keyboard. We all know about the keyboard.
If you would like a second pair of eyes on who can access your systems, or you are building software that will hold customer data, explore our IT and software services. We are happy to help you lock the right doors.