Cloud services
Cloud security
Better-protected access, data and configurations, with clear priorities.
Over-broad permissions, overly accessible data and default settings are a common cause of cloud security trouble, and they often go unnoticed.
AWS, Microsoft Azure, Google Cloud and OCI. We work inside your accounts and agree the scope in writing before we start.
01 · The problem
Problems we solve
- Some people hold administrator permissions they do not need, or accounts are shared between several users.
- Some storage or databases are open to more people or more networks than necessary.
- Access keys have not been changed in years and nobody knows where they are used.
- Nobody gets an alert if something odd happens, such as access from an unexpected location.
When it fits
- Your environment has grown without an orderly security review
- A customer or investor asks for technical evidence of how your Cloud is configured (not a certification)
02 · How we help
What we do and what you get
We review access, networks, storage and the configuration of your services and infrastructure. We tell you what is urgent, what can be improved and how to fix it, and we can help apply it.
What you get
Helps reduce the attack surface and gives more clarity about who can reach what in your environment.
- Fewer open doors: access that is not needed is reduced and what is needed remains.
- Order in permissions: we move towards each person and service having only what they need for their work.
- Clear priorities: findings are ranked by severity, so you start with what matters most.
- Technical information: you can show customers or investors how your Cloud was configured at the review date; it is not a certification or a compliance audit.
03 · Method
How we work, step by step
- Scope and minimum access. We agree in writing what is reviewed. We start with read-only access that you create, with configuration-audit permissions that do not include reading the content of your data.
- Review of access and configuration. We analyse identities, networks, storage and services on AWS, Azure, Google Cloud or OCI, depending on what you use.
- Findings by severity. Each finding is explained in plain language, with its severity and how to fix it. We go through it with you to rule out false positives.
- Fixes and good practice. Your team applies the fixes, or we do if agreed in writing with limited permissions. We leave guidelines for day-to-day work.
04 · What you receive
Concrete deliverables
- Review of identities, permissions and access
- Review of networking, storage and service configuration
- Findings classified by severity, with remediation steps
- Good-practice recommendations for your team's day-to-day
05 · Typical scenarios
Situations where we help
These are common scenarios, not Nubyron client cases.
A team that grew quickly
Typical scenario: people and services are added quickly and permissions have been granted without being reviewed.
A customer questionnaire
Typical scenario: a large customer sends questions about how the environment is protected and the team wants to answer with real data.
After a scare
Typical scenario: an exposed key or a provider notice leads the team to want to review everything calmly.
06 · Platforms and technologies
On the provider you already use
“Cloud security” on the platform you already use or want to move to: the service answers what your business needs.
- Amazon Web Services (AWS)
- Microsoft Azure
- Google Cloud
- Oracle Cloud Infrastructure (OCI)
07 · For consultancies and tech teams
Specialist capacity for your projects
For consultancies, software factories and technology teams, the Cloud security review can be added to a project as technical reinforcement, with a written scope and working in their client's accounts.
See how we work with consultancies08 · FAQ
Frequently asked questions
Is this a certification or compliance audit?
No. It is a technical review of configuration and access. It does not replace certifications or legal or regulatory advice.
Do you run penetration tests?
That is not the focus of this service. If you need it, we will say so and discuss how to approach it.
Do you see our customers' data?
The review focuses on configuration and permissions, not content. We ask for configuration-audit permissions that do not include reading the content of your data and, if anything required more, we discuss and agree it in writing first.
Do you cover all four platforms?
Yes: AWS, Azure, Google Cloud and OCI. Each has its own controls and we review them with the same approach, including when you combine several.
How is it commissioned, and what happens next?
It is commissioned as a review with a written scope. Afterwards you fix things with your team, ask us to support the fixes, or repeat the review after a while.
First step
Tell us about your case
Write to us with a general picture of your environment and your question. We propose a written scope before any work begins.
Prefer to talk for 30 minutes?(opens in a new tab)