Cybersecurity in the cloud: don’t pass the buck

Adoption of the cloud in Belgium and the EU 

It would be fair to say that Belgian companies are pioneers when it comes to adopting the cloud. According to the European Commission’s Digital Decade report from 2024, Belgian businesses are at the forefront of digitalisation. In fact the Commission’s research shows that 47.7% of companies use cloud computing. That’s well in excess of the European average of 38.9%.

Cloud computing means that you purchase computing power, storage or even software from a supplier via the internet, so that you don’t need your own servers or computers to store data or run software, etc. Essentially, you lease IT capacity from a cloud provider (such as Microsoft Azure, Amazon Web Services, Google Cloud, etc.) and you only pay for what you use. 

In the Benelux, around 42% of organisations use cloud services in which both front-end and back-end applications are migrated. In layman’s terms, this means that both the apps that customers log into to use certain services and the database and computing power required to run those apps are located in the cloud.

Challenges with shared responsibility 

This rapid move to the cloud is not without its challenges. Providers of cloud solutions tend to use the ‘shared responsibility model’. This means that companies such as Amazon Web Services, Microsoft Azure, Google, etc. are responsible for making sure their own cloud infrastructure is secure. But, as a customer, you are responsible for what you do in the cloud – that might include configurations, access management, data encryption and so on. 

In other words, cybersecurity in the cloud is a shared responsibility and that’s often where the problem lies in organisations. These issues include: 

• Shadow IT. Company employees use their own tools and programs without the IT department being aware that they are doing so. Unless there is a strict policy in place, organisations run the risk of allowing “gaps” to open up in their security.
• Poor configuration of access rights. Access Control Lists (ACL) are lists that set out who has access to which files or systems – as well as what they are allowed to do with them (read, write, delete). If the parameters for the ACL are set too broadly, anyone can access sensitive files via the internet.
• Open storage buckets. These are storage containers in the cloud (such as a digital folder). They have no password or access restriction and this makes them accessible to anyone who has the link. So, if someone accessing them has malicious intentions, they can download, modify or delete the contents of the brochure.

However, there is a legal framework in place that requires Belgian companies to comply with rules such as GDPR and the new NIS2 directive. The launch date for the new directive is 17th April 2026, which means we will only be able to see the effect of the new legislation in a few years’ time. 

An additional challenge is what is known in the jargon as multi-cloud complexity. As the term implies, we use various systems and platforms from different providers, so keeping everything secure and up to date requires a fair amount of expertise and a clear, consistent strategy.

‘As an organisation, you need to ask yourself the extent to which you can and want to protect yourself against downtime at your cloud providers,’ says Kristof Tuyteleers, security officer at DNS Belgium. ‘The major cloud providers have datacentres in multiple countries, which minimises the impact of any downtime at any specific location. However, a multi-cloud strategy doesn’t necessarily mean that it’s the best solution. Yes, it might reduce the risk of failure or dropouts, but it also increases the complexity – and hence the chance of errors – of your infrastructure. This can sometimes result in the lower net availability of ICT services. Which in turn means that every organisation needs to assess whether it has the necessary resources and expertise to manage and maintain their systems in a sustainable manner.’ 

Best practices: what can you do yourself?

Cybersecurity in the cloud starts with having a strong foundation. Fortunately, there are a number of practical steps that your organisation can take to give your digital environment better protection:

• Zero Trust Architecture. Trust is good; verification is better. With a Zero Trust approach, no one is automatically granted access – every user, every device and every request is verified first. This limits the risks of internal and external threats.
• Security of APIs. An API (Application Programming Interface) is a set of rules that enables software applications to communicate with each other. APIs are often the gateway to sensitive data. Ensure strict access control, continuous monitoring and rate limiting to prevent misuse. Also consider authentication via tokens and limiting public endpoints.
• Encryption & key management. Encrypt your data – both when it is being sent and when it is being stored. Combine this with robust key management, preferably centralised, so that you always retain control over who has access to what information.