OPERATE · Managed Cloud Security
Cloud Security Operated, Patched and Monitored by DAAKYI.
We run security for your cloud workloads, including those on DAAKYI Cloud, with continuous configuration and threat monitoring.
- Cloud adoption that stays secure
- Fewer configuration-driven exposures
- In-jurisdiction operations where required
- 1Discover and Classify
- 2Set the Baseline
- 3Monitor and Detect
- 4Contain and Recover
- 5Report and Improve
Executive Summary
- 01Cloud security fails most often through misconfiguration and stolen identities, not through exotic exploits.
- 02Continuous configuration checks and cloud-aware detection close the gap between periodic reviews.
- 03Documented playbooks and posture reporting turn cloud incidents and audits into predictable, evidence-backed processes.
The Challenge
Cloud environments change constantly, and configuration drift creates exposure between reviews.
Few teams have the skills to monitor cloud-specific threats around the clock.
The DAAKYI Approach
DAAKYI monitors cloud configuration and threats, operates cloud security controls and responds to cloud incidents.
Workloads hosted on DAAKYI Cloud are operated and patched by DAAKYI.
- 01
Cloud security monitoring
- 02
Configuration monitoring
- 03
Cloud incident response
- 04
Posture reporting
In Depth
How the Discipline Works
Inventory Before Control
Cloud security starts with knowing what exists. Accounts, subscriptions, projects, identities, storage, networks and workloads are discovered continuously, because new resources appear whenever a developer runs a template or a pipeline deploys. Each asset is tied to an owner and a data classification. Without that map, alerts have no context and findings have no one to act on them. The inventory also exposes shadow accounts and forgotten test environments, which are common sources of exposed storage and stale credentials. Teams that skip this step end up monitoring only what they remember to register.
Configuration as the Baseline
A baseline defines what a correct configuration looks like for each service. Frameworks such as the CIS Critical Security Controls and vendor guidance inform it, and the organization's own policy adds to it. Monitoring compares live state against the baseline and flags deviations such as public storage buckets, open management ports, disabled logging or overly broad roles. Drift matters because infrastructure-as-code can be correct while a console change quietly overrides it. Findings are ranked by exploitability and data exposure, not by count. Fixes are made in the template where possible, so the correction survives the next deployment instead of being reverted.
Detection Tuned to Cloud Behavior
Cloud attacks rarely look like malware on a host. They look like valid API calls from an unusual place. Detection draws on control-plane audit logs, identity events, network flow records and workload telemetry. Analysts look for new access keys, privilege escalation, disabled logging, unusual data transfer and resource creation in regions the business never uses. Mapping detections to MITRE ATT&CK tactics shows which stages of an intrusion are covered and which are blind. Alerts are enriched with asset owner and data sensitivity, so triage can decide quickly whether a signal is a deployment, a mistake or an intrusion.
In the cloud, the attack is often a valid API call. Only continuous monitoring of configuration and identity can tell it from legitimate work.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Cloud Security Monitoring | Threats detected in cloud workloads. | – | – | OPERATE stage | Managed Security Services, Long-Term Operations |
| Configuration Monitoring | Drift identified and corrected. | – | – | OPERATE stage | Managed Security Services, Long-Term Operations |
| Cloud Incident Response | Containment in cloud environments. | – | – | OPERATE stage | Managed Security Services, Long-Term Operations |
| Managed Cloud Security | Operated and patched by DAAKYI. | – | – | OPERATE stage | Managed Security Services, Long-Term Operations |
Cloud Security Monitoring
Threats detected in cloud workloads.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services, Long-Term Operations
Configuration Monitoring
Drift identified and corrected.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services, Long-Term Operations
Cloud Incident Response
Containment in cloud environments.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services, Long-Term Operations
Managed Cloud Security
Operated and patched by DAAKYI.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services, Long-Term Operations
How It Works
How Managed Cloud Security Works
- 01Monitor
- 02Detect
- 03Respond
- 04Report
Methodology
The Method, Step by Step
- 1
Discover and Classify
Enumerate every account, subscription and project, including those created outside central procurement. Record owners, environments and data types. Classify workloads by business criticality so that monitoring depth and response priority match actual risk. This step also confirms which logs exist, which are missing, and where retention is too short to support investigation.
- 2
Set the Baseline
Translate policy and framework requirements into measurable configuration rules per cloud service. Agree on approved regions, encryption settings, identity standards and logging requirements. Document accepted exceptions with an owner and an expiry date, so deviations are deliberate decisions rather than silent gaps that accumulate over time.
- 3
Monitor and Detect
Collect control-plane, identity, network and workload telemetry into one analytic view. Run configuration checks continuously and behavioral detections against the logs. Tune rules against the organization's normal deployment patterns to cut false positives. Review detection coverage against MITRE ATT&CK on a schedule and close gaps found.
- 4
Contain and Recover
Follow a documented playbook aligned with NIST SP 800-61. Containment in the cloud often means revoking credentials, isolating a workload with network rules or snapshotting a disk for evidence. Actions are logged. Recovery rebuilds from known-good templates rather than patching a compromised instance, and the root cause is fixed at source.
- 5
Report and Improve
Turn findings into posture reporting for technical teams and executives. Show trends in drift, time to remediate and open exceptions. Feed lessons from incidents back into baselines and detections. Reporting maps to control frameworks so auditors can trace evidence without rebuilding it each cycle.
Operating Model
Delivered from the OPERATE Pillar
Pillar position
OPERATE
Security Operations & Managed Resilience
Engagement model
Managed Security Services
SOC, MXDR and managed cloud security under SLAs.
Best for · 24/7 coverage without building in-house
Engagement model
Long‑Term Operations
Multi-year operations and continuous improvement.
Best for · Critical systems needing sustained assurance
Threat Scenarios
What It Looks Like in Practice
Publicly Exposed Storage
How It Shows Up
A storage container is switched to public access during troubleshooting and never switched back. Access logs later show reads from unknown addresses.
Response
The policy change is detected, access is restricted and logs are reviewed to establish what was read. The template is corrected so the setting cannot reappear.
Leaked Access Key
How It Shows Up
A developer key committed to a public repository is used from an unfamiliar network to list resources and enumerate permissions.
Response
The key is revoked, actions taken with it are reconstructed from audit logs, and related secrets are rotated. Secret scanning is added to the pipeline.
Privilege Escalation
How It Shows Up
A low-privilege role attaches an administrator policy to itself or assumes a more powerful role it has never used before.
Response
The added permissions are removed and the session is cut off. Evidence is preserved, and trust relationships between roles are reviewed for the path used.
Audit Logging Disabled
How It Shows Up
Logging is stopped or redirected in one account, followed by unusual resource creation and data movement.
Response
Logging is restored and the event is treated as a strong hostile indicator. Analysts then investigate the window before the change, using any secondary log sources.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Publicly Exposed Storage | A storage container is switched to public access during troubleshooting and never switched back. Access logs later show reads from unknown addresses. | The policy change is detected, access is restricted and logs are reviewed to establish what was read. The template is corrected so the setting cannot reappear. |
| Leaked Access Key | A developer key committed to a public repository is used from an unfamiliar network to list resources and enumerate permissions. | The key is revoked, actions taken with it are reconstructed from audit logs, and related secrets are rotated. Secret scanning is added to the pipeline. |
| Privilege Escalation | A low-privilege role attaches an administrator policy to itself or assumes a more powerful role it has never used before. | The added permissions are removed and the session is cut off. Evidence is preserved, and trust relationships between roles are reviewed for the path used. |
| Audit Logging Disabled | Logging is stopped or redirected in one account, followed by unusual resource creation and data movement. | Logging is restored and the event is treated as a strong hostile indicator. Analysts then investigate the window before the change, using any secondary log sources. |
Outcomes
What Your Institution Gains
- Cloud adoption that stays secure
- Fewer configuration-driven exposures
- In-jurisdiction operations where required
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Cloud Asset and Identity Inventory | Gives every alert and finding an owner, an environment and a data classification. |
| Configuration Baseline and Exception Register | Defines correct settings per service and records each approved deviation with an expiry. |
| Detection Coverage Map | Shows which MITRE ATT&CK tactics the monitoring covers in cloud environments and where gaps remain. |
| Incident Record and Post‑Incident Review | Documents timeline, containment actions and root cause so fixes reach templates and detections. |
| Posture Report | Presents drift, remediation progress and framework alignment in a form executives and auditors can use. |
| Role | Responsibility |
|---|---|
| Client Cloud Platform Owner | Approves baseline changes, fixes findings in the templates and decides on exceptions for the workloads they run. |
| Provider Cloud Security Analyst | Triages alerts, validates configuration findings and escalates confirmed threats with asset context attached. |
| Incident Lead | Directs containment, coordinates with engineering and keeps the evidence trail and decision log complete. |
| Client Risk Owner | Accepts or rejects residual risk, and decides on regulatory notification when personal data may be involved. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Reactive
Cloud accounts grow without a central inventory. Issues surface through incidents or annual reviews.
Stage 2
Visible
Assets and logs are centralized and a baseline exists. Drift is detected, but remediation depends on manual tickets.
Stage 3
Managed
Detection, triage and response run continuously against defined playbooks. Exceptions have owners and expiry dates.
Stage 4
Optimized
Templates enforce the baseline before deployment, detections are tested against adversary techniques, and incident lessons change engineering practice.
Frameworks and Regulation
The Standards That Shape This Work
NIST CSF 2.0
Cloud posture can be scored against all six of its functions, from Govern through Recover. Managed cloud security aligns most directly with Identify, Detect, and Respond, while Govern establishes accountability for cloud risk.
ISO/IEC 27001:2022
Annex A lists 93 controls in four themes, and the technological theme covers areas such as logging, configuration management and access control. ISO/IEC 27002:2022 gives implementation guidance for those controls in cloud settings.
MITRE ATT&CK Enterprise
Its 14 tactics give a common language for cloud detections. Teams use them to test which stages of an intrusion their monitoring can actually see.
Ghana Data Protection Act, 2012 (Act 843)
It sets eight privacy principles, including data security safeguards. Personal data held in cloud workloads must be protected with appropriate technical measures, which configuration and threat monitoring support.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for coverage across every cloud account and region, including those the business rarely uses.
- Look for clear boundaries on who fixes what, since the provider may detect a flaw that only your engineers can change.
- Look for response playbooks that cover credential revocation, workload isolation and evidence preservation in cloud terms.
- Look for reporting that maps findings to the frameworks and regulations your auditors apply.
Questions to ask a provider
- Which log sources do you ingest by default, and which require changes in our environment?
- How do you separate a legitimate deployment from an intrusion when both appear as valid API calls?
- Which remediation actions can you take directly, and which need our approval?
- How is evidence preserved and retained so it supports a regulatory notification or an audit?
Regulatory & Industry Context
The Obligations This Service Supports
Operations support ISO/IEC 27001, SOC 2 and data residency obligations under Act 843 and the Nigeria Data Protection Act.
Frameworks DAAKYI helps clients implement
- ISO/IEC 27001
- SOC 2
- Ghana Act 843
- Nigeria Data Protection Act
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Telemetry sources and partner technologies
Technology partners DAAKYI works with in this area.
Framework and regulatory alignment
- ISO/IEC 27001
- SOC 2
- Ghana Act 843
- Nigeria Data Protection Act
Operations support ISO/IEC 27001, SOC 2 and data residency obligations under Act 843 and the Nigeria Data Protection Act.
Architecture reference
How Managed Cloud Security Works: Monitor → Detect → Respond → Report.
DAAKYI monitors cloud configuration and threats, operates cloud security controls and responds to cloud incidents.
Control-Plane Logging and Identity Telemetry
Control-plane logs record every API call that creates, changes or deletes a resource. They are the primary evidence source in cloud investigations. Collect them for all accounts and regions, including those unused, and ship them to storage in a separate, access-restricted account so an intruder cannot erase them. Pair them with identity telemetry: role assumptions, federated sign-ins, access key creation and multi-factor changes. Correlate the two to follow an attacker who moves from a stolen key to an assumed role to a data store. Alert on logging being stopped, modified or redirected, since that action often precedes other hostile activity. Retention must outlast typical dwell time.
Drift Detection and Infrastructure as Code
Drift is the gap between declared and actual state. Infrastructure-as-code templates declare the intended configuration, and the live environment is compared to them. Pre-deployment scanning of templates catches insecure settings before they ship, such as unencrypted volumes or wide-open security groups. Runtime checks catch what scanning cannot, including console edits, emergency fixes and resources created outside the pipeline. When drift is found, the choice is to revert automatically, open a ticket or accept the change with an expiry. Automatic reversion suits low-risk settings. Production databases usually need review first, because a blind revert can cause an outage. Every correction should land in the template, or the drift returns.
Glossary
Key Terms
- Configuration Drift
- The gap that opens between a cloud resource's intended settings and its live settings after unreviewed changes.
- Control Plane
- The management layer of a cloud platform where resources are created, changed and deleted through API calls.
- Cloud Security Posture Management
- The practice of continuously assessing cloud configuration against a defined baseline and ranking deviations by risk.
- Shared Responsibility Model
- The division of security duties between a cloud platform operator and its customer, which varies by service type.
Related
Explore Connected Capabilities
Proof Points
What We Can Stand Behind
- DAAKYI Cloud is built with Sangfor, with data center capacity from Digital Realty (deck).
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
Technology partners
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Managed Cloud Security
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Managed Cloud Security with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Managed Cloud Security will respond.
Explore a Sovereign Cloud Solution