Reducing these risks requires a security solution that can identify every cloud instance, cloud-based virtual machine, and hybrid cloud-premise asset. Once these assets are identified, they need to be classified by asset type and software. An effective solution will then compare the cloud assets to similar known assets in a device knowledgebase to benchmark appropriate attributes and asset behavior.
Once that data is collected and analyzed, the next step is to monitor the cloud assets to detect changes in behavior. For example, a cloud server holding sensitive data that suddenly starts communicating with an unknown device outside the organization should trigger an alert and policy enforcement to halt data transfer.