Cloud Security Starts with Architecture

Expert insight by Dr Bernardo Pulido-Gaytan
| National College of Ireland

Organisations invest heavily in cloud security technologies, from firewalls and encryption to identity and access management systems and AI-driven threat detection.

However, implementing sophisticated security tools does not automatically make an organisation secure. Systems can still expose sensitive information, experience service disruptions or fail to meet regulatory requirements.

According to Dr Bernardo Pulido-Gaytan, Postdoctoral Research Associate at the National College of Ireland, the problem is often not the absence of technology but the architectural decisions determining how that technology is used.

Effective cloud security begins by understanding what an organisation needs to achieve, which assets it must protect and what level of risk it can reasonably accept.

Enterprise Architecture: Connecting Business and Technology

Enterprise Architecture (EA) provides a structured approach to aligning an organisation’s objectives, business processes, information systems and technological infrastructure.

Rather than focusing on individual technologies, Enterprise Architecture considers how different systems and components work together to support organisational goals.

This is particularly important when planning cloud infrastructure, where different organisations may have very different requirements despite using similar technologies.

Both organisations require secure cloud environments, but their architectural decisions should reflect their different business priorities and risk profiles.

Frameworks such as TOGAF support the alignment of business strategy with information systems and technology, while security architecture frameworks such as SABSA connect business requirements and risks with security objectives and controls.

The fundamental principle is that security requirements should be shaped by the organisation they are intended to protect.

Infrastructure Design Is More Than a Technical Decision

Infrastructure design often involves selecting servers, configuring networks, choosing cloud providers and deciding which cloud service models best support an organisation.

Common approaches include Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS), alongside more specialised services such as Database as a Service (DBaaS) and Machine Learning as a Service (MLaaS).

However, these decisions have consequences that extend beyond technology.

They influence operational resilience, scalability, cost, regulatory compliance and the organisation’s ability to respond to changing business conditions.

Understanding Shared Responsibility in the Cloud

Cloud service models also introduce important questions about responsibility and accountability.

Under the shared responsibility model, cloud providers and customers have different security responsibilities depending on the services being used.

Moving from IaaS to PaaS or SaaS changes which infrastructure components an organisation manages directly, but it does not remove the need to protect information, manage access and configure services securely.

Choosing a cloud architecture is therefore also a decision about risk, control and accountability.

Security by Design: Building Protection into the Architecture

Security should be considered from the earliest stages of system planning, rather than being introduced after development or deployment.

This is the principle behind Security by Design: incorporating security requirements throughout system architecture and the development lifecycle.

This approach is increasingly important in cloud environments, where applications rely on distributed services, APIs, containers and dynamically provisioned infrastructure.

Consider a healthcare organisation developing a cloud-based patient portal. Patients need to manage appointments and access medical information, while internal services interact with databases containing sensitive records.

Selecting firewalls, encryption tools and monitoring systems is important, but those technologies do not answer every security question.

These are architectural questions, and addressing them early can significantly influence the effectiveness of subsequent security controls.

Zero Trust, Least Privilege and Resilient Systems

Modern security architecture relies on principles designed to minimise unnecessary access and reduce the potential impact of an attack.

Zero Trust

Zero Trust follows the principle of never trust, always verify. Access should not be granted simply because a user or service is operating within a supposedly trusted network.

Instead, access decisions should consider identity, permissions and relevant contextual information.

Least Privilege

The principle of least privilege limits users and services to the permissions necessary to carry out their responsibilities.

This reduces unnecessary access to sensitive systems and helps limit potential damage if an account or service is compromised.

Network Segmentation

Network segmentation and microsegmentation establish boundaries between systems and services.

By restricting unnecessary communication, these approaches can help contain security incidents and prevent attackers from moving freely between infrastructure components.

Resilience and Recovery

Redundant infrastructure and disaster recovery mechanisms help ensure that critical services remain available when technical failures or cyberattacks occur.

Where Should Organisations Begin?

Before choosing a cloud provider or investing in additional security tools, organisations should establish a clear understanding of their business requirements and security priorities.

Dr Pulido-Gaytan recommends considering several fundamental questions:

Answering these questions provides a foundation for informed infrastructure and security decisions.

Ultimately, Enterprise Architecture connects business needs with technological capabilities, while Infrastructure Design and Security by Design translate those requirements into systems that are secure, resilient and fit for purpose.

Cloud security does not start with the tools an organisation purchases. It starts with the decisions that determine how those tools will support the business.