Cybersecurity, cloud computing and big data are often owned by different teams, budgeted separately and discussed as separate strategies. That separation is where many of today’s most damaging incidents begin. The cloud is where the data lives, the data is what attackers want, and security is what determines whether the first two create value or liability.
The practical implication for leaders is to manage them as one system. Every decision to move data to the cloud is a security decision. Every analytics platform is a high-value target. And the same data and machine learning that power business insight are also among the best tools for defending the environment. This article explains how the three connect and what an integrated approach looks like in practice.
Three roles in one system
A useful analogy is an orchestra. Cloud computing is the stage and infrastructure: flexible, scalable, and home to cloud-native applications, SaaS platforms and hybrid architectures. It lets businesses scale on demand and reach new markets quickly, but it also changes where the boundaries of the organization sit.
Big data, analytics and machine learning are the performance: every transaction, sensor reading and customer interaction becomes data that can be stored cheaply in the cloud and analyzed for decisions, personalization and new opportunities.
Cybersecurity is what keeps the performance from being hijacked. In the cloud, the perimeter is no longer a firewall around a building. It is identity, configuration and data access. Threat analysis has to cover who can reach each dataset, how it is encrypted, and whether anyone would notice if it were copied.
Where the three collide: lessons from cloud data breaches
The 2024 wave of breaches involving customer accounts on the Snowflake data platform illustrates the point. According to Mandiant’s investigation, a financially motivated group used credentials stolen by infostealer malware, often years earlier, to log into customer accounts that did not require multi-factor authentication, then extracted large volumes of data. Snowflake’s platform itself was not breached. The failures were on the customer side: identity, credential hygiene and monitoring around a big-data store in the cloud.
That pattern is typical. Under the shared responsibility model, the cloud or SaaS provider secures the underlying infrastructure, while the customer is responsible for identities, configurations and the data itself. Most cloud data exposures come from that customer side: storage left publicly accessible, service accounts with far more access than they need, stale credentials, and analytics copies of production data sitting in environments with weaker controls. For more on the credential side, see Credential and Identity Theft Is Reaching Crisis Levels.
Using big data to defend the cloud
The relationship also runs the other way. Security itself is now a big-data problem. Cloud audit logs, identity provider sign-ins, endpoint telemetry and network flows add up to enormous volumes that only scalable cloud storage and analytics can handle affordably.
Machine learning applied to that data powers behavioral analytics: spotting an account that suddenly queries far more records than usual, a service principal used from an unfamiliar location, or a data export at 3 a.m. Rule-based alerts alone struggle with these patterns. The same data engineering skills a company uses for business intelligence, such as pipelines, schemas and retention policies, are what make security analytics work. Organizations that treat security logs as a first-class data product detect and investigate incidents far faster than those that treat logging as an afterthought.
There is a cost dimension to plan for. Ingesting every log into a premium security platform gets expensive quickly, so many organizations now tier their telemetry: high-value signals such as identity events and data-platform access go to real-time detection, while bulk logs land in cheaper cloud storage where they can still be searched during an investigation. Deciding which is which is itself a data governance exercise, and it is best made jointly by the security and data teams.
An integrated approach: practical steps
In March 2024, the NSA and CISA jointly published their top ten cloud security mitigation strategies, covering shared responsibility, identity and access management, network segmentation, data protection, and secure DevOps. Combined with data governance practices, they translate into a concrete program:
- Integrate security from day one. Embed security reviews, infrastructure-as-code scanning and secret detection into cloud-native development and DevOps pipelines rather than auditing after deployment.
- Require phishing-resistant MFA on every data platform. This includes admin consoles, SaaS analytics tools and data warehouses. Replace long-lived keys for service accounts with short-lived credentials where possible.
- Classify and map your data. Know which datasets contain personal, financial or regulated information, where copies live, and who owns each one.
- Apply least privilege to data access. Grant analysts and services access to the data they need, mask or tokenize sensitive fields in analytics environments, and review access quarterly.
- Encrypt and control keys. Encrypt data at rest and in transit, and for sensitive data consider customer-managed keys.
- Harness data for defense. Centralize cloud, identity and data-platform logs, retain them long enough to investigate, and apply behavioral analytics to detect unusual access and bulk exports.
- Continuously check posture. Use cloud security posture management to find misconfigurations such as public storage or overly permissive roles, and fix them on a defined timeline.
Organizing for it
The hardest part is usually organizational. Cloud, data and security teams have different priorities: speed, insight and risk reduction. Integration works when each dataset and cloud account has a named owner, when security requirements are written into platform standards rather than negotiated project by project, and when a single governance forum decides how data may be used. The trade-off is some added friction up front, such as access requests and reviews, in exchange for avoiding the far larger cost of a breach or a failed audit.
Frequently asked questions
Is data safer in the cloud or on-premises?
Major cloud providers generally secure their infrastructure better than most companies can on their own. Whether your data is safe depends on how you configure identities, access and monitoring, which remain your responsibility.
What is the most common cause of cloud data breaches?
Customer-side issues: stolen or weak credentials without MFA, misconfigured storage or permissions, and excessive access for users and service accounts.
How does big data help cybersecurity?
It lets security teams store and analyze large volumes of logs and telemetry, and apply machine learning to detect unusual behavior, such as abnormal data access or bulk exports, that rule-based tools miss.
Bringing cloud, data and security together
Delana Technologies helps organizations secure cloud data platforms, set up data governance, and build security analytics that work, aligned with frameworks through our cybersecurity compliance services. See also why cloud computing and cybersecurity are two sides of the same coin. Call 239.414.5126 or contact us.
Sources: NSA and CISA, “Top Ten Cloud Security Mitigation Strategies” (March 2024); Mandiant (Google Cloud), “UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion” (June 2024).