Cloud Security Posture Review in Australia: What to Check and How to Prioritise
What a cloud security posture review covers in Australia: shared responsibility, identity, network, data, logging, backups and ASD guidance.
What does a cloud security posture review cover?
A cloud security posture review checks how your cloud accounts are configured against good practice: identity and access first, then network exposure, data protection and encryption, logging and monitoring, backups and recovery, and governance. It produces a prioritised list of fixes. In Australia, ASD's cloud security guidance for tenants, the Essential Eight and, for regulated entities, APRA standards are useful reference points.
This guide is for technical leads, founders and operations managers. It is educational: ZSpace Labs does not provide security assurance, penetration testing or managed security. For migration planning, see cloud migration in Australia; for responding to incidents, cyber incident response plans.
Key takeaways
- Understand the shared responsibility model for each service.
- Start with identity: MFA, least privilege, no long-lived keys.
- Find anything exposed to the internet that should not be.
- Turn on and retain audit logs; alert on high-risk events.
- Test backups and restores.
- Use native posture tools for continuous checks.
Review areas
| Area | Typical checks |
|---|---|
| Identity and access | MFA for all humans, phishing-resistant for administrators; least privilege; no root or owner use; key rotation; joiner and leaver process |
| Network exposure | Public endpoints, open security groups, management ports, storage buckets and databases reachable from the internet |
| Data protection | Encryption at rest and in transit, key management, data classification, data location |
| Logging and monitoring | Audit logs enabled, centralised and retained; alerts on privileged actions and configuration changes |
| Backups and recovery | Immutable or separate backups, tested restores, recovery objectives |
| Workloads | Patching, container image scanning, secrets management |
| Governance | Account structure, guardrail policies, tagging, cost and asset inventory |
Australian guidance
- ASD's Cloud computing security for tenants covers tenant responsibilities and mitigations.
- The Essential Eight covers baseline mitigations such as MFA, patching, restricting admin privileges and backups.
- The Information Security Manual provides detailed controls, often used by government and suppliers.
- APRA-regulated entities should consider CPS 234 and CPS 230.
- Privacy Act APP 11 requires reasonable steps to secure personal information; APP 8 applies to overseas disclosure.
- Provider benchmarks, such as the CIS Benchmarks (CIS), give detailed configuration checks.
How to run a review
Agree scope (accounts, subscriptions, projects and services) and who will act on findings. Inventory resources and identities. Run the provider's native security posture tools and benchmark checks, then review results manually because automated tools miss context. Interview the people who run the environment. Rate each finding by likelihood and impact, starting with internet exposure and privileged access. Record fixes in the team's normal backlog with owners and dates, and re-check.
Worth noting
Do not test or scan systems you do not own or have written permission to test, including cloud provider infrastructure outside your account. Follow your provider's testing policy.
Prioritising fixes
- First: public exposure of data or admin interfaces; administrators without MFA; leaked or long-lived keys.
- Next: missing audit logs; overly broad roles; untested backups.
- Then: encryption gaps, patching, image scanning, tagging and policy guardrails.
- Ongoing: continuous posture monitoring and periodic access reviews.
Hypothetical example: a SaaS company after migration
This example is hypothetical. After moving to the cloud, a small SaaS company ran its provider's posture tools and found a storage bucket with public read access, two administrator accounts without MFA, and audit logs retained for only a few days. They fixed the bucket and MFA the same day, centralised logs with longer retention, replaced access keys in CI with short-lived credentials, and tested a database restore. A security firm was then engaged for an independent review before a major customer's procurement assessment.
Common mistakes
- Assuming the provider secures everything.
- Relying only on automated scores.
- Shared administrator accounts.
- Logs turned on but never reviewed.
- Backups in the same account with the same credentials.
- Findings that never reach the backlog.
Related guides
- Cloud cost optimisation for account structure and tagging.
- Application monitoring and observability for alerts.
- Business continuity for digital products for recovery planning.
- Website security in Australia for application-level controls.
- Secure web application development for building securely.
Conclusion
A cloud security posture review is a structured way to find configuration gaps before attackers do. Focus first on identity and exposure, make logging and backups dependable, use Australian guidance as reference, and keep checks continuous. Engage qualified security professionals for assurance; no review guarantees security.
Building on the cloud?
ZSpace Labs is an India-based, remote-first technology studio working with Australian and international businesses on secure web applications and cloud-hosted software. We do not provide security assurance or penetration testing, but we can work alongside your security provider to fix findings in the software we build.
Common questions.
A structured check of how your cloud accounts are configured against good practice: identity and access, network exposure, data protection, logging and monitoring, backups, and governance. It finds misconfigurations and gaps and prioritises fixes. It is different from a penetration test, which actively tries to exploit weaknesses.