Response time after alarm: 4 days and more!  

Advertising

The Cloud Threat Report Volume 7 reveals: After an alert for a security team, attackers have up to 40 days to carry out their attack in 4 percent of cases. Attackers are helped by the 60 percent unpatched high or critical vulnerabilities.

The cloud attack surface is as dynamic as the cloud itself. As organizations around the world increasingly share, store, and manage data in the cloud, the attack surface for businesses is expanding exponentially. This expansion often happens in unknown, overlooked, or poorly secured ways. For attackers, every workload in the cloud represents an opportunity, and without proper management, organizations are exposed to myriad risks.

Advertising

Target of attack: Everyday problems in the cloud

🔎 Only 40 percent respond to security alerts within 4 days (Image: Unit 42). 

While previous reports focused on a single threat (e.g. identity access management, supply chain attacks, and container security), the Unit 42 Cloud Threat Report Volume 7, “Navigating the Expanding Attack Surface,” addresses a larger, broader problem: attackers have become adept at exploiting common, everyday issues in the cloud. These issues include misconfigurations, weak credentials, lack of authentication, unpatched vulnerabilities, and malicious open source software (OSS) packages.

The report provides a breakdown of two different real-world instances of cloud attacks observed by Unit 42 in 2022. After anonymizing and de-identifying victims, the researchers reveal how attackers exploited sensitive data leaked on the dark web and the business disruption caused by ransomware.

Important findings of the report

• On average, it takes security teams 145 hours (about six days) to resolve a security incident. 60 percent of companies take more than four days to resolve security issues.
• In most enterprise cloud environments, 80 percent of alarms are triggered by just XNUMX percent of security policies.
• 63 percent of codebases in production have unpatched vulnerabilities rated high or critical (CVSS >= 7.0)
• 76 percent of organizations do not enforce MFA for console users, while 58 percent of organizations do not enforce MFA for root/admin users.

Common monitoring measures in the cloud

Based on extensive data collected in 2022, the report examines real-world security breaches that affected medium-sized and large organizations. He describes the issues observed in thousands of multi-cloud environments and analyzes the impact of OSS vulnerabilities on the cloud. Specifically, the researchers analyzed the workloads across 210.000 cloud accounts across 1.300 different companies. As many companies now have multiple cloud implementations, the vulnerabilities are increasingly being targeted by attackers.

While user errors such as insecure configurations remain the main problem, Unit 42 researchers have also identified issues stemming from the ready-made templates and default configurations provided by cloud service providers (CSPs). While these settings and features are convenient and make it easier to adopt new technologies, they do not put users in the safest place to start.

Exemplary results:

• 76 percent of organizations are not enforcing MFA for console users.
• Sensitive data was found in 63 percent of publicly accessible storage buckets.

Cloud: risks of open source software (OSS)

Open source software was one of the driving forces behind the cloud revolution. However, the increasing use of OSS in the cloud also increases complexity - and with it the likelihood of obsolete or discontinued software, malicious content and slower patching cycles. This makes it the responsibility of end users to validate the OSS before integrating it into applications. This task is especially difficult when companies have to manage numerous projects, all of which depend on potentially thousands of OSSs.

Recommendations: Make life difficult for attackers

Enterprises should expect the attack surface for cloud-native applications to continue to grow as attackers find increasingly creative ways to attack the misconfiguration of cloud infrastructure, APIs, and the software supply chain itself.

To protect against these threats, the report provides practical guidance on closing the cloud security gaps, such as:

An automated backup process should be in place for all cloud workloads that would disrupt business operations in the event of a failure. Backups should be stored in protected locations isolated from the production environment across multiple geographic locations to avoid a single point of failure. All organizations should have business continuity and disaster recovery (BC/DR) plans that include the process of restoring from backups.

In addition, the researchers predict that the industry will move away from point security solutions towards cloud-native application protection platforms (CNAPPs) that offer a full spectrum of capabilities across the entire application development lifecycle. Gartner backs up this claim that there will be a significant uptick in CNAPP adoption, reporting a 70% increase in customer inquiries about CNAPPs between 2021 and 2022.

Matching articles on the topic