As Google Cloud and Workspace take steps to add additional layers of protection to the MFA process with passkeys and device-bound session credentials, cloud customers should also adopt a comprehensive defense-in-depth strategy. Financially-motivated attackers are now routinely compromising backup systems to ensure that organizations can’t restore data after a ransomware attack and coerce them into capitulating. Despite defensive advancements, the primary entry points for threat actors — credential compromise and misconfiguration — are driven by a lack of attention to cloud security fundamentals. Today, our Office of the CISO’s Bob Mechler and Anton Chuvakin dive into the key trends and evolving threats that we tracked in our just-published Cloud Threat Horizons report.
As more organizations move workloads to the cloud, and develop applications natively in the cloud, identity needs to remain a key focus when building a cloud security strategy. Organizations increased their cloud usage – with a dramatic surge in the number of organizations that host more than half their workloads in the cloud (see Figure 1 below). The ongoing transition to cloud platforms has meant that more sensitive data is stored in the cloud, making it more tempting for adversaries to exploit. Translating awareness into an impenetrable security posture requires the right combination of technology, processes, and human-focused solutions that account for how attacks actually unfold. Cloud-app governance capabilities provide important critical visibility into cloud security threats. As your employees, contractors, and partners share more data in the cloud, the risk of a breach increases.
DLP Users leaking sensitive data through personal apps is top of mind for most organizations, with 66% of organizations using DLP to restrict data flow into personal apps. Still, organizations also see people using personal apps with malicious intent, such as when exiting employees take client data, source code, or intellectual property using personal apps. As a result, malicious content downloads from popular cloud apps occur in 88% of organizations every month. Trojan.CobaltStrike is a powerful commercial penetration testing framework that enables various functionalities, including a highly customizable command and control framework to evade traditional network-based detection.
Best Practices from Industry for Implementing a Zero Trust Architecture
Kubernetes events sit somewhere else. Hybrid cloud security threats are not a new species of threat. APTs and supply-chain attacks don’t usually look like a single anomalous event. The security teams that catch these early are the ones that enrich every log event with context at ingestion.
The largest single-month spike (281%) occurred in May, and we noted the most substantial increase in these alerts (204%, 247% and 122%) in August, October and December, as shown in Figure 1. In contrast to posture management tools, runtime monitoring tools continuously monitor the cloud environment and often require a dedicated agent to maintain visibility of the cloud resources. By collecting the logs from cloud compute instances, CSP logging resources and third-party cloud SaaS applications, CDR security tools can identify, alert on and prevent malicious cloud events. For example, an alert will be triggered if an IAM policy is overly permissive and allows access to other cloud resources. However, by December 2024, the average cloud environment saw more than 200 of those same alerts – a worrying signal of increased activity.
As companies increase their use of cloud hosting for storage and computing, the risk of an attack on their cloud services increases because the cloud presents a highly dynamic and distributed landscape. Cloud vulnerabilities are weaknesses, oversights, or gaps in cloud infrastructure that attackers or unauthorized users can exploit to gain access into an organization’s environment and potentially cause harm. Visibility is an essential requirement that enables the timely detection of threats and anomalies and the rapid response to any incidents.
- The KuppingerCole data security platforms report offers guidance and recommendations to find sensitive data protection and governance products that best meet clients’ needs.
- Continuous monitoring, detection, and alerts use tools like IdPs and SIEM systems to provide real-time monitoring of cloud resources and help organizations respond quickly to security threats.
- Today’s cloud computing security issues and evolving cybercrime trends introduce new risks that create a need for solutions that can assist companies with prevention, detection, and response.
- For the remainder of this report, we are going to shift our focus to related legacy risks on top of which these new risks have been added.
- Compromised personal machines can also reveal sensitive data due to reused passwords and stored browser credentials.
These attacks cause increased costs of cloud resources, reduced performance for business-related operations, and potential security breaches. Many recent attacks targeting IaaS and PaaS environments have exploited unsecured credentials, resulting in cryptojacking, data breaches and destruction of intellectual property and other sensitive data. Misconfiguration of cloud resources is a leading cause of data breaches and can result in deleted or modified resources and service interruptions. Each year, the Cloud Security Alliance (CSA) releases its “Top Threats to Cloud Computing” study to raise awareness of key risks and vulnerabilities in the cloud and promote strong security practices. Multi-tenancy increases the attack surface, leading to an increased chance of data leakage if the separation controls fail.
President Biden signed a bill into law that requires ByteDance to sell its U.S. The Royal ransomware group has changed its name to BlackSuit and revamped its tactics, techniques and procedures (TTPs) to sharpen its attacks, CISA and the FBI announced this week in an updated advisory about this cybercrime posse. Specifically, these teams are seeing increased speed, automation, data analysis, scalability and productivity. Offensive-security teams, tasked with identifying their organizations’ cybersecurity weak spots, are already benefiting from AI in general, and from large language models (LLMs) and LLM-powered AI agents in particular. Although challenges remain, AI holds great promise for offensive-security teams, especially those involved with vulnerability assessments, penetration testing and red teaming.
The exposed databases contained personal information that could be used for social engineering and targeted phishing attacks. It https://www.lemonfiles.com/42896/details-endpoint-encryption.html was a supply chain ransomware attack, designed to gain administrative control over Kaseya services and use them to infect the networks of managed service providers and their customers. They may also use malware or other techniques to gain unauthorized access to cloud resources. Insider threats in a cloud environment refer to the risk of unauthorized access or misuse of cloud computing resources by individuals within an organization, such as employees or contractors.
- Even employees with the best intentions can unintentionally divulge their credentials, download malware to the network, or share sensitive files on a non-secure channel or without encryption.
- Cloud settings keep growing as providers add more services over time.
- Threat actors, such as ransomware groups, use compromised credentials as well as other organizational vulnerabilities such as weak authentication controls in hopes of gaining access into systems.
- In this section, we shift our focus to external adversaries and the ongoing risks that they continue to pose to organizations throughout the world.
#9 Data Loss
Restricting access to cloud services is necessary because it helps to limit the potential attack surface. When data is encrypted, it is converted into a format that is unreadable to anyone without the proper decryption key. Verizon said most of these attacks were due to the “human element”, as a result of remote work during the COVID-19 crisis.
Top seven cloud security risks
The attacker exploited a misconfigured web application firewall, which allowed access to the sensitive data stored in Capital One’s cloud https://www.recycle100.info/why-arent-as-bad-as-you-think-20/ environment. These errors often stem from a lack of unified cloud strategies, inadequate training, and insufficient cloud security measures. Unfortunately, this application lacked proper security measures, leading to the exposure of sensitive patient data. Shadow IT refers to any data that isn’t under the stewardship of an enterprise’s IT or security teams. Errors in the setup or management of cloud applications or services, such as firewall rules and IAM policies, may inadvertently expose sensitive data or grant undue privileges.