Cloud security best practices: the NSA's ten mitigations, translated for IT teams

In March 2024 the US National Security Agency published ten cloud security mitigation strategies, with CISA contributing to six of them. Two years on, the list still works as a checklist, because the failures it targets have not changed: weak identity controls, exposed data, and settings nobody owns.

The ten, as the NSA named them:

1. Uphold the cloud shared responsibility model
2. Use secure cloud identity and access management practices
3. Use secure cloud key management practices
4. Implement network segmentation and encryption in cloud environments
5. Secure data in the cloud
6. Defend continuous integration and continuous delivery (CI/CD) environments
7. Enforce secure automated deployment practices through infrastructure as code
8. Account for complexities introduced by hybrid cloud and multi-cloud environments
9. Mitigate risks from managed service providers in cloud environments
10. Manage cloud logs for effective threat hunting

Here is what each one means in practice for a mid-size IT team.

Know which half is yours

The shared responsibility model comes first for a reason. Your provider secures the physical data centers, hosts and network. What you are responsible for depends on the service type, but some things are always yours.

Microsoft's own guidance lists them: your data, your identities and accounts, access management, and your configurations and settings. Those stay with you in IaaS, PaaS and SaaS alike. The operating system is yours on IaaS virtual machines and the provider's on PaaS and SaaS.

Write down, for each major cloud service you use, who owns each layer. Gaps in that table are where breaches happen.

Lock down identities first

The NSA's second point is the one we would fund first. Require multifactor authentication for every human account, and phishing-resistant methods for admins. Remove standing admin rights where you can and grant them only when needed. Review service accounts and API keys, which are often over-privileged and never rotated.

Keys, encryption and segmentation

Use the provider's key management service, decide who can use and rotate keys, and log every use. Encrypt data in transit and at rest. Segment cloud networks so a compromised workload can't reach everything else in the account.

Protect the data itself

Classify what you store, block public access to storage buckets by default, and turn on versioning or immutable storage for data you can't afford to lose. Misconfigured storage remains one of the most common causes of cloud data exposure.

Treat the build pipeline as production

Points six and seven cover the software supply chain. Your CI/CD system can deploy to production, so it deserves production-grade security: MFA, limited secrets, signed artifacts and review of pipeline changes. Infrastructure as code helps because it makes your cloud configuration reviewable and repeatable, but only if the templates themselves are checked for insecure settings before they deploy.

Hybrid, multi-cloud and your providers

Each extra cloud or managed service provider adds a set of consoles, identities and logs. The NSA asks you to account for that complexity explicitly: one identity provider where possible, consistent policies across clouds, and contracts that spell out what your managed service provider can access and how they secure it.

Keep logs you can search

Turn on the provider's audit logs, send them somewhere an attacker with cloud admin rights can't delete them, and keep them long enough to investigate an intrusion that started weeks earlier.