Cloud Security Best Practices for Indonesian Businesses

One Monday morning, a logistics company owner in Surabaya found his cloud bill had ballooned to IDR 120 million in a single month. His usual subscription was two million. After investigation, it turned out his AWS account was being used to mine cryptocurrency by unknown parties. His API key had leaked, possibly from code uploaded to a public repository, and since then anyone could access his account. The money never came back.

This story is not rare. Indonesia's National Cyber and Crypto Agency (BSSN) consistently records hundreds of millions of cyberattack attempts against Indonesian digital infrastructure every year, and poorly managed cloud accounts are among the most tempting targets. Unlike an office server, cloud is accessible from anywhere in the world. One leaked credential means your entire system is open to attackers on any continent.

Many business owners think: "Cloud is safe, right, it is run by big providers?" True, the physical infrastructure is safe. But cloud security is a shared responsibility. The provider protects data centers, networks, and hardware. You protect the configuration: who can access the account, how credentials are stored, what is encrypted, and how backups are managed. The majority of cloud incidents happen not because the provider was breached, but because a user account had a weak password, a leaked API key, or overly permissive access.

This article is a practical cloud security guide for Indonesian businesses: understanding the shared responsibility model, best practices for securing accounts and data, common mistakes, concrete steps you can start today, and estimated protection costs.

Understanding the Shared Responsibility Model

Before discussing security measures, you must understand one concept that forms the foundation of all cloud security: the shared responsibility model.

Imagine renting an apartment in a well-managed building. Management is responsible for the building structure, elevators, building electricity, and lobby security. But you are responsible for locking your unit's door, not giving keys to strangers, and keeping your belongings safe. If you forget to lock the door and things go missing, it is not the building manager's fault.

In cloud, the division is similar. The provider (AWS, Google Cloud, Azure, Alibaba Cloud) is responsible for:

• Physical security of data centers
• Hardware and basic network infrastructure
• The virtualization layer that separates customers from one another

You are responsible for:

• Account credentials and access configuration (who can log in)
• Configuration of the services you use
• The data you store and how you protect it
• Application code running in the cloud
• Backup and recovery policies

The problem is that many businesses only understand the first half and ignore the second. They assume "cloud is safe" and hand over everything, including securing their accounts, without thinking. That is exactly where the gap opens.

Industry statistics consistently show that most cloud security incidents are caused by misconfiguration and user negligence, not provider weaknesses. Major cloud providers have invested billions of dollars securing their infrastructure. The weak point most often exploited is the side you control.

Main Threats to Businesses in the Cloud

What actually happens most often? These five threats are the most common.

1. Leaked credentials and unauthorized access

This is threat number one. Weak passwords, API keys stored in unsafe places, or credentials uploaded to public code repositories. Once credentials leak, attackers can enter your account, steal data, or use your resources for illegal activities like cryptocurrency mining. The crypto-mining attacks that inflate cloud bills have become one of the most common attack forms because the impact is felt directly in your account.

2. Misconfiguration

Storage accidentally made public, buckets anyone can access, databases open to the internet. These misconfigurations are the most common cause of cloud data breaches. Often they happen not from malice but from ignorance or speed: someone creates storage, then forgets to set access permissions. One industry report notes that the majority of data exposed in the cloud comes from misconfigured storage.

3. Ransomware attacks

Ransomware now targets the cloud too. Attackers encrypt your data and demand a ransom. In the cloud, the impact can be broader because data is synchronized across many devices. A good backup is the main defense: if you have a clean copy, ransom is no longer the only way out. Our website security guide covers similar attack patterns from the website side.

4. Insider threats

Not all threats come from outside. Disgruntled employees, former employees whose access was never revoked, or careless staff can be a source of leaks. Overly broad access that is never reviewed is the root of the problem.

5. Account hijacking and social engineering

Attackers use phishing or social engineering to steal login credentials. An email that looks official from a "cloud provider" or "IT team" asks you to enter your password on a fake page. Two-factor authentication (2FA) is the most effective defense against this type of attack.

Best Practices for Securing Cloud Accounts

The foundation of cloud security starts with the account. Here are practices to apply before discussing anything else.

Enable two-factor authentication for all admin accounts

This is the highest-impact step with the least effort. Two-factor authentication (2FA) means that besides a password, you also need a code from an app on your phone or a physical device to log in. Even if your password leaks, attackers still cannot get in without that second code. Enable 2FA for all admin accounts, and ideally for all accounts that can access data.

Never use the root account for daily work

The root account is the "master key" of your cloud account, with full access to everything. Cloud providers recommend: create the root account, then never use it for routine work. Create separate accounts with limited permissions for each person who needs to work. The root account is kept for emergencies, with strict 2FA.

Apply the principle of least privilege

Each person gets only the access truly needed for their job, no more. Marketing staff do not need access to the customer database. Staff handling reports do not need permission to delete data. This principle, called least privilege, limits the damage if one account is compromised. Loose permissions are an invitation for trouble.

Manage credentials securely

Never store passwords or API keys in plain-text files, sticky notes, or application code. Use a password manager for humans and a secrets management service (like AWS Secrets Manager or similar) for application keys. API keys that end up in public code are one of the most common ways cloud accounts get breached.

Review access periodically

Employees come and go. What is often forgotten: cloud accounts of departed employees are not revoked. Review the user list and permissions at least every three months. Revoke access for people who no longer work there, and adjust permissions for those who changed roles.

Use organizational structure and environment separation

Separate the production environment (the systems customers use) from development (where the team tests code). Production access is stricter; changes are tested in development first. Many providers offer ways to group accounts and resources by project or team, which helps control access and costs.

Securing Data in the Cloud

A secure account does not yet mean secure data. Data needs its own layer of protection.

Encrypt data

Encryption transforms data into code that cannot be read without a key. In the cloud, encryption applies in two places: when data is stored (at rest) and when data is sent (in transit). Almost all cloud providers offer built-in encryption that can be enabled with a few clicks. Always enable it. Also make sure connections to cloud services use HTTPS.

Manage encryption keys properly

Encryption is only as strong as its key management. Encryption keys stored in the same place as the encrypted data are useless. Use the cloud provider's key management service, which separates key storage from data and provides auditing.

Control access to data

Every piece of data — files, databases, storage — must have clear access permissions: who can read, write, delete. Periodically check whether any storage has accidentally been made public. Cloud providers offer tools to detect this automatically.

Tested backups

Data safe from unauthorized access is not necessarily safe from loss. Regular backups to a separate location, with encryption, and most importantly: tested recovery. A backup that has never been tested is not a backup. A mature backup strategy, like our 3-2-1 backup guide, determines how quickly you recover from disaster.

Understand where your data is

For Indonesian businesses, choose an appropriate cloud region, such as Jakarta or Singapore. This is not just about latency but also staying in step with the spirit of the Personal Data Protection Law, which regulates where and how Indonesian citizens' data is handled. Storing data in the right region supports compliance.

Monitoring and Detecting Threats

Prevention is not enough. You need to see what is happening in your account.

Enable logging and auditing

Record all important activity: who logged in, when, from where, what they did. Cloud providers offer logging and auditing services that record account activity. Enable them from the start, because logs activated only after an incident will not help you see what happened before.

Set up alerts for suspicious activity

Create rules that send alerts when something unusual happens: login from an unusual location, permission changes, creation of new accounts, cost spikes, or storage becoming public. These alerts can be sent to email or WhatsApp. Knowing sooner is the key to limiting damage.

Monitor costs actively

An unusual cloud bill is often an early sign of compromise. Attackers using your account to mine cryptocurrency leave a trail of cost spikes. Enable budget alarms and review bills regularly. An unexplained increase must be investigated, not ignored.

Use the provider's built-in security tools

All major cloud providers offer security tools: vulnerability scanners, dangerous-configuration detection, and compliance assessment. These give your account a security rating and a list of fixes. Many are available at low cost or free for basic features. Use them.

Cloud Incident Response Process

Even if all the steps above are applied, incidents can still happen. What separates businesses that survive from those that collapse is readiness to respond.

1. Recognize the signs early

Early detection is key. Signs to watch for: unusual logins, permission changes, cost spikes, suddenly lost or encrypted data, services stopping. The sooner you know, the less damage.

2. Isolate the suspected account

When detected, immediately revoke access to the compromised account: change the password, revoke sessions, and disable API keys. This stops attackers from continuing while you investigate.

3. Do not delete evidence immediately

Screenshots, logs, and records of conditions before recovery can be material for investigation and evidence. Do not delete anything before documenting it.

4. Recover from a clean backup

Use a backup made before the incident and make sure it is not infected. Test recovery in a separate environment before restoring to production.

5. Communicate honestly

If customer data is affected, tell them transparently. The Personal Data Protection Law requires data controllers to report impactful breaches. Honesty preserves trust better than hiding.

6. Evaluate and fix

After recovery, ask: what gap was exploited, and how do we prevent it from recurring? Fix configuration, revoke unnecessary access, and update procedures. The same incident recurs because of half-finished fixes.

Common Mistakes That Make Cloud Vulnerable

Besides not applying the practices above, there are habits that quietly weaken cloud security:

• Storing API keys in code or public repositories. This is the most common way cloud accounts get breached. One upload to a public repository, and your credentials can be copied by anyone.
• Using one password for all services. Once it leaks, everything opens.
• Giving everyone admin access. The more people hold keys, the larger the attack surface.
• Ignoring provider warnings. Security emails from cloud providers are often mistaken for spam and deleted unread.
• Not revoking former employees' access. Hanging access is an unlocked door.
• Accidentally making storage public. Always check access permissions every time you create a new resource.
• Assuming cloud is automatically safe. Providers protect infrastructure; you protect configuration. Forgetting the second part is the biggest mistake.

Estimated Cost of Securing the Cloud

How much does reasonable protection cost? Here are realistic ranges for the Indonesian market in 2026. Note that most basic practices — 2FA, least privilege, built-in encryption, logging — are available at no additional cost from providers. What you pay for is mainly time and expertise.

Compare that to the cost of one incident: a cloud bill hijacked for crypto mining can reach tens to hundreds of millions of rupiah in one month, like the logistics case at the start. A customer data breach can trigger administrative sanctions under the Personal Data Protection Law, loss of trust, and recovery costs far beyond prevention costs. Cloud security is not a cost; it is an insurance premium.

Cloud Security as an Ongoing Process

Cloud security is not a one-time project. It is a continuous process: configurations change, teams change, threats evolve, and new services are added. What was safe last month can become vulnerable this month because of one small change.

Make security part of your routine: review access periodically, monitor logs and costs, update procedures, and test backups. This is like maintaining a house: it is not enough to fix it once; it must be cared for continuously. Many businesses only realize the importance of cloud security after their first incident. You do not have to be one of them.

There is a close link between cloud security and broader infrastructure decisions. If you are considering moving to the cloud, security should be part of planning from the start, not an addition at the end. And understanding when you need an IT consultant helps you know when to rely on an internal team and when to bring in expert guidance.

Start with Small Steps Today

Cloud security can feel intimidating, but it does not have to be. Start with the highest-impact steps:

1. Enable 2FA for all admin accounts, today.
2. List everyone who has cloud access, then review whether they all still need it.
3. Check whether any storage has accidentally been made public.
4. Enable logging and cost alarms.
5. Find and remove API keys from code or public repositories.
6. Test one backup recovery process.
7. Document your incident response procedure.

These seven steps can be completed in a few days without significant cost, and they close most of the gaps that attackers most often exploit.

If your cloud account already holds customer data or production systems, consider expert guidance. The Kartech. team in Bandar Lampung helps businesses assess their cloud configuration security, implement best practices, and build response procedures. Discuss your needs via the contact page or explore our services to see how we work. We start from your problem, not from technical jargon.

Conclusion: Cloud Security Is in Your Hands

Back to the logistics company at the start. After the IDR 120 million bill incident, they recovered the account, enabled 2FA, revoked all leaked API keys, and installed budget alarms. It took time and money to clean up, but the lesson learned was far more valuable: cloud security is not the provider's responsibility; it is a shared responsibility, and your side cannot be ignored.

Major cloud providers have secured their infrastructure to world-class standards. The question is not "is cloud safe" but "are you securing your part." By understanding your responsibility, applying basic practices, monitoring activity, and responding to incidents correctly, cloud can become one of the safest environments for your business systems. All you need is the discipline to maintain it.