CISA, NSA Release Cloud Security Guides
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have issued five cybersecurity information sheets to help organizations improve the security of their cloud environments. The guides include best practices for securing cloud environments along with recommended mitigations for improving cloud security.
The cloud offers a cost-effective and flexible alternative to on-premises infrastructure and has become essential for supporting an increasingly remote workforce; however, cloud environments pose unique security challenges and each year many healthcare data breaches occur as a result of improperly secured cloud environments. Cyber threat actors are actively targeting cloud environments and are exploiting weak security configurations to gain access to sensitive data and after compromising cloud environments, often pivot to internal networks. Managed service providers (MSPs) are frequently targeted as if their environments can be breached, threat actors can abuse their high-privileged access to attack downstream clients, as was the case with the REvil ransomware attacks via Kaseya.
Cybercriminal groups and nation-state threat actors actively scan for misconfigured access controls, exploit poorly secured accounts, and use phishing and social engineering to harvest credentials and bypass multifactor authentication. Once a threat actor has compromised the cloud environment, new accounts are created, privileges are escalated, and they move laterally and target other cloud services or leverage federated identities to access the victim’s on-prem environment.
The information sheets cover secure cloud identity and access management practices, secure cloud key management practices, network segmentation and encryption, data security in the cloud, and how to mitigate the risks from MSPs in cloud environments. The information detailed in the CISA/NSA guides should not come as a surprise to network defenders who should be adhering to all the best practices included in the guides but they do serve as a useful checklist for making sure that all best practices are being followed and all appropriate mitigations have been put in place.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
