NSA and CISA jointly released “Top 10 Cloud Security Mitigation Strategies” to advise cloud users on critical security practices for migrating data. 

The National Security Agency outlines ten essential strategies to improve cloud security posture, each explained in a separate cybersecurity information sheet. 

The collaboration aims to address the growing risk of cyber attacks on cloud environments due to misconfigurations and the need to maintain security parity with on-premises systems while mitigating cloud-specific threats. 

“Rob Joyce, the NSA’s Director of Cybersecurity, has emphasized the importance of proper cloud implementation for enhancing IT efficiency and security.

He warns that the concentration of critical data in cloud services makes them prime targets for adversaries and advises customers to follow foundational security practices to avoid becoming victims.”

Uphold the Cloud Shared Responsibility Model

To avoid security gaps, cloud customers must understand the CSP’s shared responsibility model (SRM), which defines security ownership based on service type (SaaS, PaaS, and IaaS). 

SRM details vary by CSP, so close attention to documentation and potentially direct communication is crucial.  

Customers hold the CSP accountable for their part but must also fulfill their security responsibilities within the cloud tenancy. 

Use Secure Cloud Identity and Access Management Practices

Strong IAM protects cloud resources, whereas multi-factor authentication (MFA) and temporary credential management prevent unauthorized access. 

Least privilege and separation of duties principles further restrict access to minimize cloud breaches. 

Use Secure Cloud Key Management Practices

Cloud providers (CSPs) offer various key management options, from letting them handle everything (server-side encryption) to giving customers full control (client-side encryption). 

Organizations leveraging CSPs for encryption need to understand the security implications and their own responsibilities in key management.

Implement Network Segmentation and Encryption in Cloud Environments

Organizations should utilize Zero Trust security to prevent hacker access in cloud environments, which includes verifying all access requests, segmenting resources based on function, and encrypting all data at rest and in transit. 

Micro-segmentation limits communication paths for resources and encrypts data at rest and in transit, hindering malicious actors within the cloud environment.

Secure Data in the Cloud

To secure cloud data, organizations should select secure storage, restrict public IP access, enforce least privilege, use versioning, create immutable backups with recovery plans, and encrypt data. 

They must also understand cloud provider data retention policies for sensitive data storage and utilize “soft delete” for accidental or malicious deletion. 

Defending Continuous Integration/Continuous Delivery (CI/CD) Environments

CI/CD pipelines, essential for DevSecOps in cloud environments, are vulnerable to attacks due to their access to infrastructure and applications.  

To mitigate this risk, organizations must secure their CI/CD pipelines using strong access control, up-to-date tools, log auditing, security scans, and proper secret management.

Enforce Secure Automated Deployment Practices through Infrastructure as Code

Infrastructure as code (IaC) automated cloud resource deployment, reducing misconfigurations and improving security. IaC enables fast detection of unauthorized changes and integrates with security best practices.  

For secure IaC implementation, organizations should perform threat modeling, static code testing, and integrate with CI/CD pipelines. 

Account for Complexities Introduced by Hybrid Cloud and Multi-Cloud Environments

Hybrid/multi-cloud use creates management challenges like siloed operations and security gaps.

Standardizing cloud operations with vendor-neutral tools allows centralized monitoring and control across environments, improving IAM, data flow, and overall security posture. 

Mitigate Risks from Managed Service Providers in Cloud Environments

MSPs bring technical benefits but increase attack surface and to defend against this, choose MSPs with strong security practices, audit their privileged access, and integrate their services into your security and recovery processes. 

Manage Cloud Logs for Effective Threat Hunting

Cloud environments’ complex nature demands log aggregation from various sources for security professionals to analyze using SIEM, log analysis tools, and anomaly detection. 

This analysis helps identify suspicious activities like unusual logins or network traffic for real-time threat response. 

Cloud security logs provide a detailed record of activity, which can be used to detect security threats early on. Under MITRE’s D3FEND™ matrix, logs are broadly applicable under the Detect category.