Cloud Security and Mobile Security Considerations

Two of the most significant changes to the operational security environment for most organisations over the past decade are the widespread adoption of cloud-based services and the normalisation of mobile and remote working. Both developments have fundamentally changed the security landscape that managers are responsible for navigating, and both create specific challenges and obligations that require management attention.

Cloud Security: The Shared Responsibility Model

The most important concept for any manager whose organisation uses cloud services to understand is the shared responsibility model. This model defines the division of security responsibilities between the cloud service provider and the organisation using that service. The boundary between provider and customer responsibility differs depending on the type of cloud service being used:

• Infrastructure as a Service (IaaS): the provider secures the underlying physical infrastructure, including hardware, storage and networking. The customer is responsible for securing everything built on top of that infrastructure, including the operating system, applications, data and access management. This model gives customers the most control and the most responsibility.
• Platform as a Service (PaaS): the provider secures the infrastructure and the platform, including the operating system and runtime environment. The customer is responsible for securing their applications, data and access configurations. Responsibility is more evenly divided.
• Software as a Service (SaaS): the provider is responsible for the security of the application and the underlying infrastructure. The customer is primarily responsible for managing user access and entitlements, and for ensuring their data is handled appropriately within the application. This model gives customers the least control but also the least direct technical responsibility.

A critical insight from Gartner is that through 2025, 99% of cloud security failures were expected to be the customer’s fault, not the provider’s. This is not because cloud providers are inherently more secure than customers, but because the most common causes of cloud security incidents are customer-controlled factors: misconfiguration of access controls, overly permissive permissions, failure to apply security settings available within the cloud platform, and inadequate oversight of who can access what data within cloud environments.

For managers, the shared responsibility model has direct practical implications. If your team uses a cloud-based collaboration platform, a cloud storage service or a cloud-hosted application, you need to understand what security responsibilities your organisation retains, and whether they are being exercised effectively. Key questions include: who has administrative access to the cloud environment, and is that access appropriately limited? What data is stored in the cloud, and is it appropriately classified and protected? How is access revoked when a team member leaves or changes role? What visibility does your organisation have into security events and access logs within the cloud service?

Cloud Security Risks for Managers

• Misconfiguration: the most common cause of cloud security incidents. Cloud environments offer extensive configuration options that can, if incorrectly set, expose data to unintended access. A storage bucket left publicly accessible, a database without authentication required or a cloud function with excessive permissions can all create significant vulnerabilities. While configuration decisions are primarily made by technical teams, managers who advocate for security review before new cloud services are deployed contribute to preventing these issues.
• Access management: the 2025 cloud security research found that 54% of data stored in the cloud is sensitive, up from 47% the previous year, yet fewer than 10% of enterprises encrypt at least 80% of their sensitive cloud data. Managing who can access cloud-stored data, and ensuring that access is appropriate, current and revoked when no longer needed, is a managerial responsibility as much as a technical one.
• Shadow cloud adoption: when team members or departments adopt cloud services without the knowledge or approval of the IT or security function, they create risks that are invisible to the organisation’s security management. A team that uses an unapproved cloud storage service to share large files, or that uses a personal cloud collaboration tool for work purposes, may be handling sensitive data in an environment the organisation has no visibility into or contractual protections over.
• Credential security in cloud environments: phishing was the most prevalent cloud security breach method in 2024, affecting 73% of organisations that experienced a cloud breach. Attackers target cloud credentials specifically because they provide access to the data and functionality of the entire cloud environment rather than just a single on-premises system. Multi-factor authentication is particularly important for cloud access and should be treated as a baseline requirement rather than an optional enhancement.

Mobile Security Considerations

The normalisation of mobile and remote working has created a security environment that looks very different from the traditional office-based model in which all staff worked on organisation-controlled devices connected to a monitored network. The security challenges this creates are primarily ones that managers need to understand and help address, even though the technical solutions are implemented by IT teams.

• Personal and unmanaged devices: as established in the Verizon 2025 DBIR, 46% of compromised business credentials came from non-managed or personal devices. When staff access corporate systems from personal laptops, tablets or smartphones, the organisation has limited visibility into whether those devices meet minimum security standards, whether they are up to date with security patches, whether they are protected by appropriate security software, or whether they are shared with other household members who may inadvertently expose corporate data.
• Unsecured networks: staff working from home or in public spaces such as coffee shops, airports or hotels may connect to networks that are not adequately secured. Data transmitted over unsecured networks can be intercepted; public Wi-Fi networks in particular are a common attack surface. Virtual private networks (VPNs) can encrypt traffic between a device and the corporate network, but only if they are consistently used and correctly configured.
• Physical security in non-office environments: the clear desk and screen lock policies that protect sensitive information in an office environment do not automatically apply when people work from home. A device left unattended in a shared living space, a screen visible in a public area, or a sensitive conversation conducted within earshot of others all represent physical security risks in remote working environments.
• Lost and stolen devices: mobile devices are significantly more likely to be lost or stolen than desktop computers. A device containing work email, files and application access that is lost or stolen without adequate device encryption, remote wipe capability or strong access controls represents a potentially serious security incident.

Managers play a direct role in mobile security by ensuring their team members understand the specific security requirements that apply to remote and mobile working, by modelling those requirements in their own behaviour and by raising concerns with their IT or security function when they observe practices that may create risk.