As a new Orca Security Report shows, cloud vulnerabilities allow access to critical data in just three steps: known vulnerabilities, unsecured storage resources, and failure to follow best practices allow for an average cloud attack path of just three steps to directly access an organization's crown jewels reach.
Orca Security has released the 2022 State of the Public Cloud Security Report. The study provides important insights into the current state of public cloud security and shows where the most critical security gaps can be found. One of the report's key findings is that the average attack path is only three steps away from a crown jewel asset*, meaning an attacker only needs to find three related and exploitable vulnerabilities in a cloud environment to exfiltrate data or infiltrate to blackmail companies.
Cloud workload analysis
The report, produced by the Orca Research Pod, provides the key insights from analyzing cloud workload and configuration data collected from billions of cloud assets on AWS, Azure and Google Cloud. The Orca Cloud Security Platform scanned these from January 1st to July 1st, 2022. The study identifies where critical vulnerabilities still exist and provides recommendations on what steps organizations can take to reduce their attack surface and improve cloud security posture.
"The security of the public cloud depends not only on the cloud platforms that provide secure cloud infrastructure, but also very much on the health of an organization's workloads, configurations and identities in the cloud," said Avi Shua, CEO and co-founder by Orca Security. “Our latest State of the Public Cloud Security Report shows that there is still a lot to be done in this area – from unpatched vulnerabilities to overly permissive identities to storage resources left open. However, it is important to remember that companies can never eliminate all risks in their environment. They just don't have the manpower to do it. Instead, companies should be strategic and ensure that the risks that threaten the company's most critical assets are always addressed first.”
The main findings of the report
The Orca Security 2022 State of the Public Cloud Security Report shows:
- The Crown Jewels are dangerously close: The average attack path takes only three steps to reach a Crown Jewels asset. This means that an attacker only needs to find three interconnected and exploitable vulnerabilities in a cloud environment to exfiltrate data or extort a company.
- Vulnerabilities are the most important first attack vector: 78 percent of identified attack paths use known vulnerabilities (CVEs) as the first attack vector, demonstrating that organizations need to prioritize vulnerability patching even more.
- Basic safety practices are not followed: Many organizations still do not consistently apply basic security measures such as multi-factor authentication (MFA), least privilege privileges, encryption, strong passwords, and port security. For example, 42 percent of the companies surveyed grant administrative permissions to more than 50 percent of their users. 71 percent use the standard service account on Google Cloud and 7 percent have neglected internet-facing assets (i.e. an unsupported operating system or unpatched for more than 180 days) with open ports 80, 443, 8080, 22, 3389 or 5900.
- Cloud-native services are overlooked: Although cloud-native services are easy to start, they still need to be maintained and properly configured: 69 percent of the companies surveyed have at least one serverless function that reveals secrets in the environment variable. 70 percent have a Kubernetes API server that is publicly accessible. 16 percent of containers are in a neglected state (ie an unsupported operating system or unpatched for 180+ days).
More at Orca.security
About Orca Security Orca Security delivers out-of-the-box security and compliance for AWS, Azure, and GCP—without the gaps in coverage, alert fatigue, and operational costs of agents or sidecars. Simplify cloud security operations with a single CNAPP platform for workload and data protection, cloud security posture management (CSPM), vulnerability management, and compliance. Orca Security prioritizes risks based on security issue severity, accessibility, and business impact.