Current corporate security measures or organizational structures are often planned from the perspective of products, information security governance frameworks, security policies, certifications, monitoring, or threat intelligence. This can lead to a focus on individual components without seeing the big picture, or vice versa. However, it overlooks the fact that the security planning of information systems or network designs is the key to strengthening the foundation and ensuring long-term security. This presentation will draw on 18 years of experience as a Security Architect in the InfoSec departments at Trend Micro and ASUS, to design a 'Secure by Design' and 'Security by Default' cloud security management framework.