The Cloud: Security Threat or opportunity? (Spoiler, it’s both!)

Jon Rohrich, security and compliance specialist at Microsoft Canada, argues that the cloud is both a new attack surface and the best chance most organisations have to improve their security. He opens with the attacks seen in cloud tenants: password spray, malicious Exchange forwarding rules, internal phishing aimed at privilege escalation, OneDrive exfiltration, supply-chain tampering and consent abuse by rogue applications. With the perimeter gone, he frames the answer around SASE and zero trust, where identity is the front door and every access request is judged on user, device health, location and data classification. The core of the talk is the shared responsibility model: the provider covers the physical data centre, network and host, while accounts, endpoints and data governance always stay with the customer, which is why unprotected admin accounts and open storage buckets still cause breaches. He walks through how a hyperscaler secures its side (unmarked data centres, background checks, just-in-time access, secure development lifecycle, bug bounties, audit reports, threat telemetry) and closes on the customer toolset: single sign-on, MFA, endpoint detection, cloud SIEM, CASB, data labelling and DLP, noting that MFA alone blocks the vast majority of identity-based attacks.