Compliance and Governance Threats

Cloud adoption often outpaces governance capabilities, creating compliance and security gaps. Shadow IT thrives in cloud environments where developers can provision resources with credit cards. These ungoverned resources lack security controls, compliance alignment, and often persist after projects end. Threat modeling must consider not just approved architectures but likely shadow IT patterns.

Configuration drift represents a persistent threat in dynamic cloud environments. Resources provisioned correctly might drift toward insecurity through incremental changes. Automated remediation can help, but might also create availability risks if too aggressive. The balance between security enforcement and operational flexibility requires careful consideration during threat modeling.

Audit logging gaps create blind spots that attackers exploit. Not all cloud services provide adequate logging by default. Log retention might be insufficient for forensics. Centralized logging architectures might miss some services. Without comprehensive audit trails, detecting and investigating breaches becomes nearly impossible. Threat modeling must ensure adequate visibility across all cloud resources.

Shared responsibility confusion leads to security gaps where customers assume providers handle certain controls or vice versa. This confusion is particularly acute during cloud migrations where traditional security models no longer apply. Clear documentation of security responsibilities and regular validation helps, but threat modeling must explicitly address boundary areas where responsibilities overlap or transition.