Cloud Security Risks for Small Businesses, and How to Mitigate Them
When a business moves its email and files to Microsoft 365 or Google Workspace, the security conversation changes. Nobody is going to steal the server from a closet any more; Microsoft’s data centres are safer than any office. What happens instead is that someone’s password is phished and their mailbox is used to redirect an invoice payment, or a folder is shared with “anyone with the link” and indexed by a search engine, or a former employee still has access six months after leaving, or a file library is deleted and nobody finds out the recycle bin emptied thirty days ago. We have folded two earlier articles, on the risks of cloud storage and on cloud security recommendations, into this one. It lists the real cloud security risks for a small business, ranked by how often we see them, with the control that closes each.
First, who is responsible for what
Every cloud provider works on a shared responsibility model. The provider secures the buildings, the hardware, the network and the platform itself, and publishes audits to prove it. The customer is responsible for identities and passwords, the devices that connect, the data and who it is shared with, the configuration of the tenant, and backing up what matters. Every cloud incident we have handled at a small business sat on the customer’s side of that line, which is good news: those are the things you can control.
The risks, ranked
| Risk | How it happens | The control that closes it |
|---|---|---|
| 1. Account takeover | A phished or reused password; MFA fatigue prompts; phishing kits that steal the signed-in session after MFA | MFA on every account, enforced by Conditional Access; phishing-resistant sign-in for admins; alerts on unusual sign-ins and new inbox rules |
| 2. Sharing and permission mistakes | “Anyone with the link” sharing left on; whole libraries shared with a customer; guest accounts never removed | Sharing settings tightened to specific people; expiring links; a quarterly review of external sharing and guests |
| 3. Data loss | Deletion, overwrite or ransomware syncing through OneDrive; retention windows expiring; a departed user’s account deleted with their files | A separate backup of the tenant with its own credentials; retention policies; offboarding that preserves data |
| 4. Offboarding gaps | Former staff and contractors keep working logins, app passwords and forwarding rules | Same-day offboarding: sessions revoked, licences reassigned, mail forwarded, devices wiped |
| 5. Third-party apps | Someone grants an app access to their mailbox and files with one click; the app is malicious or breached | Admin consent required for apps; periodic review of granted permissions |
| 6. Unmanaged devices | Company data on personal phones and laptops with no encryption, screen lock or wipe | Device management with compliance rules; app protection on phones; Conditional Access requiring a compliant device |
| 7. Configuration drift | Legacy authentication left on; security defaults never enabled; audit logging off; settings nobody has reviewed since setup | A baseline (Microsoft Secure Score or the CIS benchmark), reviewed quarterly |
| 8. Compliance and residency | Regulated data in a tenant with no business associate agreement, no labels and no proof of where it lives | The right licence and agreement; sensitivity labels and data loss prevention; documented data location |
| 9. Custom applications and APIs | A cloud-hosted line-of-business application with weak authentication or an exposed interface | Vendor security review; MFA and single sign-on; regular patching and testing |
| 10. Provider outage or lock-in | A service is down for a morning, or a plan to leave is impossible because nothing is exportable | A continuity plan that names what to do during an outage; backups in a format you can read without the provider |
Closing the two biggest ones
Account takeover is the cloud incident. It is how invoice fraud, payroll diversion and data theft happen, and it needs no malware. Multi-factor authentication on every account stops most of it, and Conditional Access, included in Microsoft 365 Business Premium, is what makes it mandatory rather than optional; our guide to what Business Premium includes lists the tools. Administrators should use phishing-resistant methods, passkeys or hardware keys, because the phishing kits that capture a signed-in session defeat codes and prompts. Sign-in monitoring, for impossible travel, new countries, consent grants and new inbox rules, catches the takeovers that get through; it is part of what Huntress watches for our clients. If people are receiving prompts they did not request, why do I keep receiving Microsoft Authenticator codes explains what that means.
Sharing mistakes are the quiet one. Tighten the tenant so that links default to specific people, external sharing is allowed only where the business needs it, guest accounts expire, and someone reviews the external-sharing report each quarter. Sensitivity labels and data loss prevention rules stop card numbers and patient records leaving by email at all.
Back up what the provider does not
Microsoft and Google keep the service running; they do not promise to give you last Tuesday’s version of a file library after a ransomware infection synced through OneDrive, or the mailbox of an employee whose account was deleted, or anything past the retention window. A separate backup of the tenant, held by a different provider with its own credentials and tested by restoring, is a standard control and a cheap one. Our article on whether cloud data needs backing up explains the details, and the backup pricing calculator gives the monthly figure.
Devices, apps and people
Data reachable from anywhere means the laptop in the taxi and the phone by the pool are part of the perimeter. Device management with encryption enforced and remote wipe, and Conditional Access that requires a managed device to open company data, make that manageable; our encryption guide covers the laptop side. Third-party apps need an admin’s approval before they can read mail or files, a setting most tenants have never changed. And people need short, regular security awareness training, because the phishing that starts most cloud incidents is aimed at them; the phishing quiz shows current examples. When someone leaves, our offboarding checklist closes the access the same day.
Configuration, compliance and a plan
Every tenant drifts. Legacy authentication is left on, audit logging was never enabled, security defaults were switched off during a migration and never restored. A baseline, Microsoft Secure Score or the CIS Microsoft 365 benchmark, reviewed quarterly, catches it. Regulated businesses also need the right paperwork and labels: a business associate agreement and the HIPAA security checklist for health data, the CMMC self-check for defence work, and evidence of where data lives for anyone whose customers ask. Finally, write down what happens during an outage and after a breach; our vCISO service produces that plan, and our incident response plan article is the template.
How we handle cloud security for clients
Under a managed plan the controls above are configured at onboarding and reviewed quarterly: MFA and Conditional Access enforced, sharing tightened, the tenant backed up, devices enrolled, app consent restricted, sign-ins monitored by Huntress, and staff trained. The cloud support services page describes the ongoing side, and the cyber insurance readiness check shows how these controls map to the questions insurers ask. Our comparison of public, private and hybrid cloud covers where workloads that do not suit Microsoft 365 should live.
Free tools from OAC Technology
- Cyber insurance readiness check: fourteen questions insurers ask, scored in a minute
- Email spoofing check: whether a criminal can send email as your company
- Cloud backup pricing calculator: a monthly figure for server and Microsoft 365 backups
Common questions
Is the cloud less secure than a server in our office?
No, and usually the opposite. Microsoft and Google run better data centres than any small business can. What changes is where the risk sits: with your logins, your sharing settings, your devices and your configuration. The provider secures the platform; you are responsible for the rest, and that part is where incidents happen.
Does Microsoft back up our Microsoft 365 data?
Not in the way people assume. Microsoft keeps the service running and provides recycle bins and retention windows, but deleted mail and files age out, and a ransomware infection that syncs through OneDrive is faithfully replicated. A separate backup of Microsoft 365 is a standard control, and the same applies to Google Workspace.
Is multi-factor authentication enough?
It stops the majority of account takeovers, which is why it comes first. It does not stop everything: phishing kits now capture the signed-in session after MFA, and people approve prompts they did not start. Conditional Access rules, phishing-resistant methods for administrators and monitoring of sign-ins close the gap.
What is the shared responsibility model?
The division of security duties between the cloud provider and the customer. The provider secures the physical data centres, the hardware and the platform. The customer secures identities, devices, data, permissions and configuration. Every cloud incident we have seen at a small business fell on the customer’s side of that line.
Do we still need cloud backup if we use OneDrive and SharePoint?
Yes. OneDrive and SharePoint are storage with a recycle bin, not a backup: deletions, overwrites and ransomware all sync, and retention windows expire. A backup kept by a separate provider, with its own credentials, is what lets you restore last Tuesday’s version of a library after something goes wrong.
What is the best first step?
Turn on multi-factor authentication for every account and require it through Conditional Access, then review who can share what externally. Those two changes address the two most common incidents. Then back up the tenant and enrol the devices.
Talk to us
If you would like to know how your Microsoft 365 or Google Workspace tenant scores against these ten risks, we will review it and send you the findings at no charge. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
