{"id":20439,"date":"2026-11-06T14:25:36","date_gmt":"2026-11-06T13:25:36","guid":{"rendered":"https:\/\/www.asecus.ch\/?p=20439"},"modified":"2026-11-06T14:29:38","modified_gmt":"2026-11-06T13:29:38","slug":"cloud-security-in-practice","status":"publish","type":"post","link":"https:\/\/www.asecus.ch\/en\/news\/cloud-security-in-practice\/","title":{"rendered":"Cloud Security in Practice"},"content":{"rendered":"\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-mw4zq1mj-0457efe9ee48f9896adda81ac0cb3331\">\n.avia-section.av-mw4zq1mj-0457efe9ee48f9896adda81ac0cb3331{\nbackground-repeat:no-repeat;\nbackground-image:url(https:\/\/www.asecus.ch\/wp-content\/uploads\/2020\/08\/header_ueber-uns-300x104.png);\nbackground-position:50% 0%;\nbackground-attachment:scroll;\n}\n.avia-section.av-mw4zq1mj-0457efe9ee48f9896adda81ac0cb3331 .av-section-color-overlay{\nopacity:0.6;\nbackground-color:#05668d;\n}\n<\/style>\n<div id='mobile-max-heigth'  class='avia-section av-mw4zq1mj-0457efe9ee48f9896adda81ac0cb3331 main_color avia-section-default avia-no-border-styling  avia-builder-el-0  el_before_av_textblock  avia-builder-el-first  hero-container avia-full-stretch avia-bg-style-scroll av-section-color-overlay-active av-minimum-height av-minimum-height-custom av-height-custom  container_wrap fullsize'  data-section-bg-repeat='stretch' data-av_minimum_height_px='250'><div class=\"av-section-color-overlay-wrap\"><div class=\"av-section-color-overlay\"><\/div><div class='container av-section-cont-open' style='height:250px'><main  role=\"main\" itemprop=\"mainContentOfPage\"  class='template-page content  av-content-full alpha units'><div class='post-entry post-entry-type-page post-entry-20439'><div class='entry-content-wrapper clearfix'>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-mw4zsylg-ea4a8ce95bcda3585c34169e1d76c302\">\n#top .av-special-heading.av-mw4zsylg-ea4a8ce95bcda3585c34169e1d76c302{\npadding-bottom:10px;\ncolor:#ffffff;\nfont-size:70px;\n}\nbody .av-special-heading.av-mw4zsylg-ea4a8ce95bcda3585c34169e1d76c302 .av-special-heading-tag .heading-char{\nfont-size:25px;\n}\n#top #wrap_all .av-special-heading.av-mw4zsylg-ea4a8ce95bcda3585c34169e1d76c302 .av-special-heading-tag{\nfont-size:70px;\n}\n.av-special-heading.av-mw4zsylg-ea4a8ce95bcda3585c34169e1d76c302 .special-heading-inner-border{\nborder-color:#ffffff;\n}\n.av-special-heading.av-mw4zsylg-ea4a8ce95bcda3585c34169e1d76c302 .av-subheading{\nfont-size:18px;\n}\n\n@media only screen and (min-width: 480px) and (max-width: 767px){ \n#top #wrap_all .av-special-heading.av-mw4zsylg-ea4a8ce95bcda3585c34169e1d76c302 .av-special-heading-tag{\nfont-size:0.8em;\n}\n}\n\n@media only screen and (max-width: 479px){ \n#top #wrap_all .av-special-heading.av-mw4zsylg-ea4a8ce95bcda3585c34169e1d76c302 .av-special-heading-tag{\nfont-size:0.8em;\n}\n}\n<\/style>\n<div  class='av-special-heading av-mw4zsylg-ea4a8ce95bcda3585c34169e1d76c302 av-special-heading-h1 custom-color-heading blockquote modern-quote  avia-builder-el-1  avia-builder-el-no-sibling  top-special-heading av-inherit-size'><h1 class='av-special-heading-tag '  itemprop=\"headline\"  >Cloud Security in Practice<\/h1><div class=\"special-heading-border\"><div class=\"special-heading-inner-border\"><\/div><\/div><\/div>\n<\/div><\/div><\/main><!-- close content main element --><\/div><\/div><\/div><div id='after_section_1'  class='main_color av_default_container_wrap container_wrap fullsize'  ><div class='container av-section-cont-open' ><div class='template-page content  av-content-full alpha units'><div class='post-entry post-entry-type-page post-entry-20439'><div class='entry-content-wrapper clearfix'>\n<section  class='av_textblock_section av-mw4zuru8-fa13004268eb1dea0d67f3f1066aa769 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><div class=\"breadcrumb breadcrumbs avia-breadcrumbs\"><div class=\"breadcrumb-trail\" ><span class=\"trail-before\"><span class=\"breadcrumb-title\">You are here:<\/span><\/span> <span  itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BreadcrumbList\" ><span  itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/ListItem\" itemprop=\"itemListElement\" ><a itemprop=\"url\" href=\"https:\/\/www.asecus.ch\/en\/\" title=\"Asecus\" rel=\"home\" class=\"trail-begin\"><span itemprop=\"name\">Home<\/span><\/a><span itemprop=\"position\" class=\"hidden\">1<\/span><\/span><\/span> <span class=\"sep\">\/<\/span> <span  itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BreadcrumbList\" ><span  itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/ListItem\" itemprop=\"itemListElement\" ><a itemprop=\"url\" href=\"https:\/\/www.asecus.ch\/en\/news\/cloud-security-in-practice\/\" title=\"Cloud Security in Practice\"><span itemprop=\"name\">Cloud Security in Practice<\/span><\/a><span itemprop=\"position\" class=\"hidden\">2<\/span><\/span><\/span><\/div><\/div>\n<\/div><\/section>\n<\/div><\/div><\/div><!-- close content main div --><\/div><\/div><div id='av_section_2'  class='avia-section av-mw4zvt6n-87650138eb76cb988f3985165e10ae21 main_color avia-section-default avia-no-border-styling  avia-builder-el-3  el_after_av_textblock  el_before_av_section  avia-bg-style-scroll container_wrap fullsize'  ><div class='container av-section-cont-open' ><div class='template-page content  av-content-full alpha units'><div class='post-entry post-entry-type-page post-entry-20439'><div class='entry-content-wrapper clearfix'>\n<div class='flex_column_table av-mw4zxir8-f9095827bb6153fcde7ab4459a8a1956 sc-av_one_full av-equal-height-column-flextable'>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-mw4zxir8-f9095827bb6153fcde7ab4459a8a1956\">\n.flex_column.av-mw4zxir8-f9095827bb6153fcde7ab4459a8a1956{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-mw4zxir8-f9095827bb6153fcde7ab4459a8a1956 av_one_full  avia-builder-el-4  avia-builder-el-no-sibling  first flex_column_table_cell av-equal-height-column av-align-middle av-zero-column-padding  '     ><p>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-mw4zzf19-0104affa65a233c6901ee28d19d361d5\">\n#top .av-special-heading.av-mw4zzf19-0104affa65a233c6901ee28d19d361d5{\nmargin:50px 0 30px 0;\npadding-bottom:10px;\n}\nbody .av-special-heading.av-mw4zzf19-0104affa65a233c6901ee28d19d361d5 .av-special-heading-tag .heading-char{\nfont-size:25px;\n}\n.av-special-heading.av-mw4zzf19-0104affa65a233c6901ee28d19d361d5 .av-subheading{\nfont-size:15px;\n}\n<\/style>\n<div  class='av-special-heading av-mw4zzf19-0104affa65a233c6901ee28d19d361d5 av-special-heading-h2 blockquote modern-quote  avia-builder-el-5  el_before_av_textblock  avia-builder-el-first '><h2 class='av-special-heading-tag '  itemprop=\"headline\"  >Securing hybrid and multi-cloud environments: three typical gaps from practice and how to close them.<\/h2><div class=\"special-heading-border\"><div class=\"special-heading-inner-border\"><\/div><\/div><\/div><br \/>\n<section  class='av_textblock_section av-mw5063rj-6934b01da548ea8afd7edb49d5dd931d '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><p>In recent years, many Swiss companies have moved parts of their IT infrastructure to the cloud, mostly to Microsoft Azure. The migration was often carried out quickly, without adequately adapting IT security to the new environment. This creates security gaps that attackers exploit deliberately: uninspected traffic, a lack of transparency during incidents and inconsistent security policies.<\/p>\n<p>In our cloud security projects, we keep encountering the same three challenges. Here we share what we have learned and which technologies have proven effective.<\/p>\n<h4>Is your Azure environment as well protected as your data centre?<\/h4>\n<p>The most common route to the cloud is a hybrid environment: the existing data centre remains in place while Azure is added. The connection is set up quickly, but adapting the security measures is often postponed.<\/p>\n<p>In our projects, we repeatedly find that Azure thus becomes an extension of the internal network, but without the security controls that are taken for granted on-premises. Traffic on the link to the data centre (backhaul) is not inspected, there is no segmentation within Azure (east-west), and traffic to the internet (north-south) often flows unprotected via public IP addresses. If a system in Azure is compromised, an attacker can exfiltrate data unnoticed or work their way into the internal corporate network.<\/p>\n<p><strong>Our solution:<\/strong> we deploy a next-generation firewall as a central control point in Azure, protecting all connections, whether backhaul, east-west or north-south, according to the same rules as on-premises.<\/p>\n<h4>Do you know what is really happening in your cloud?<\/h4>\n<p>When a security incident occurs, the first question is: what exactly happened? In many cloud environments, this is hard to answer, and the longer the analysis takes, the greater the damage.<\/p>\n<p>Cloud flow logs usually show only the source IP, destination IP, port, protocol and whether a connection was allowed or blocked. Depending on the service tier, the cloud providers\u2019 firewall services add domain names, full URLs and threat alerts. However, the application actually behind a connection often remains unclear.<\/p>\n<p><strong>Our solution:<\/strong> we supplement this data with the logs generated by a next-generation firewall, creating genuine visibility. Every connection is logged together with the identified application and its content. Our customers can see at a glance which applications are in use, how much data is flowing where, and where threats are occurring. This makes incidents much faster to trace, and all logs can be forwarded centrally to an existing SIEM.<\/p>\n<h4>Do you have an overall view of all your cloud environments?<\/h4>\n<p>Besides Azure, other platforms such as AWS or Google Cloud are often in use, each with its own security tools, consoles and rule sets. In our projects, we see that security policies are therefore maintained in several places and drift apart over time. This makes it almost impossible to ensure a consistent level of security.<\/p>\n<p><strong>Our solution:<\/strong> we rely on a firewall platform that integrates seamlessly into all major cloud environments. Using central management, we define security policies once and enforce them consistently in the data centre and across all clouds.<\/p>\n<h4>Why do we rely on Palo Alto Networks?<\/h4>\n<p>The cloud providers\u2019 firewall services have developed considerably in recent years. The Premium tier of Azure Firewall, for example, now offers intrusion prevention, URL filtering and inspection of encrypted traffic. In hybrid and multi-cloud environments, however, our experience shows that Palo Alto Networks offers decisive advantages.<\/p>\n<ul>\n<li><strong>One platform for all environments.<\/strong> Whether in the data centre, as a virtual firewall or as a cloud service, Palo Alto uses the same technology everywhere, so policies can be transferred directly.<\/li>\n<li><strong>Security at application and user level.<\/strong> The cloud providers\u2019 firewalls filter by IP addresses, ports, and domain names or URLs. Palo Alto identifies the application in use regardless of the port and assigns every connection to a user. This provides far greater insight into network traffic.<\/li>\n<li><strong>Integrated threat prevention.<\/strong> Intrusion prevention, malware analysis, URL filtering and DNS security are built in. Depending on the tier, the cloud providers cover some of this, but they lack sandbox analysis of unknown files.<\/li>\n<li><strong>Central management.<\/strong> With Panorama or the cloud-based Strata Cloud Manager, all firewalls can be managed centrally, both on-premises and in the cloud.<\/li>\n<\/ul>\n<h4>How can Asecus help?<\/h4>\n<p>Asecus has been helping Swiss companies protect themselves against cyberattacks since 1997. Our interdisciplinary team has extensive experience in securing on-premises, cloud and hybrid environments. We serve more than 160 active customers from a wide range of industries.<\/p>\n<p>Our key insight: a next-generation firewall delivers the greatest value when it is deployed specifically where the cloud\u2019s native tools reach their limits.<\/p>\n<p>Our approach is as follows:<br \/>\n1. Assessment: we analyse the existing environment, data flows and requirements.<\/p>\n<p>2. Architecture: we define where the firewall usefully complements the cloud\u2019s native tools.<\/p>\n<p>3. Implementation: we integrate the firewalls and migrate the policies without disrupting ongoing operations.<\/p>\n<p>4. Operation: we support our customers and continuously adapt the security measures.<\/p>\n<\/div><\/section><\/p><\/div><\/div><!--close column table wrapper. Autoclose: 1 -->\n\n<\/div><\/div><\/div><!-- close content main div --><\/div><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-mw507c50-a5099ada71a04ce3181ca3660c6498f4\">\n.avia-section.av-mw507c50-a5099ada71a04ce3181ca3660c6498f4{\nmargin-top:0px;\nmargin-bottom:0px;\n}\n<\/style>\n<div id='av_section_3'  class='avia-section av-mw507c50-a5099ada71a04ce3181ca3660c6498f4 alternate_color avia-section-default avia-no-border-styling  avia-builder-el-7  el_after_av_section  avia-builder-el-last  avia-bg-style-scroll container_wrap fullsize'  ><div class='container av-section-cont-open' ><div class='template-page content  av-content-full alpha units'><div class='post-entry post-entry-type-page post-entry-20439'><div class='entry-content-wrapper clearfix'>\n<section  class='av_textblock_section av-mw508i9w-cbe1470648a2c46a1ecd255cce31bf2c '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><p><strong>Would you like to learn more about cloud security? We look forward to hearing from you, with no obligation.<\/strong><\/p>\n<\/div><\/section>\n<section class=\"asecus_hubspot_contact_form_section \"  itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div id=\"hubspot_form\"><\/div><\/section>\n\n","protected":false},"excerpt":{"rendered":"<p>Securing hybrid and multi-cloud environments: three typical gaps from practice and how to close them.<\/p>\n","protected":false},"author":8,"featured_media":20432,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[182],"tags":[282,134,189],"class_list":["post-20439","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-hero-en","tag-highlighted-en","tag-news-en"],"_links":{"self":[{"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/posts\/20439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/comments?post=20439"}],"version-history":[{"count":3,"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/posts\/20439\/revisions"}],"predecessor-version":[{"id":20442,"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/posts\/20439\/revisions\/20442"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/media\/20432"}],"wp:attachment":[{"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/media?parent=20439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/categories?post=20439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.asecus.ch\/en\/wp-json\/wp\/v2\/tags?post=20439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}