search menu icon-carat-right cmu-wordmark

Cloud Security Best Practices Derived from Mission Thread Analysis

July 2019 Technical Report
Timothy Morrow, Vincent LaPiana, Donald Faatz, Angel Luis Hueca

Presents practices for secure, effective use of cloud computing and risk reduction in transitioning applications and data to the cloud. Considers needs of limited-resource businesses.


Software Engineering Institute

CMU/SEI Report Number



This report presents four important security practices that are practical and effective for improving the cybersecurity posture of cloud-deployed information technology (IT) systems. These practices help to address the risks, threats, and vulnerabilities that organizations face in deploying or moving applications and systems to a cloud service provider (CSP).

The practices address cloud security issues that consumers are experiencing, illustrated by several recent cloud security incidents. The report demonstrates the practices through examples using cloud services available from Amazon Web Service (AWS), Microsoft, and Google.

The presented practices are geared toward small and medium-sized organizations; however, all organizations, independent of size, can use these practices to improve the security of their cloud usage. The focus here is on hybrid deployments where some IT applications deploy or move to a CSP while other IT applications remain in the organization’s data center. Small and medium-sized organizations likely have limited resources; where possible, these practices describe implementation approaches that may be effective in limited-resource situations.