With nearly 81% of cloud-using organizations experiencing security incidents in the cloud over the past year, service providers will need to rethink the current measures for cloud security.
A recent report from machine identity management firm Venafi shows that nearly half of the affected groups experienced no less than four security incidents in a 12-month period.
In recent months, the security and operational complexity of cloud deployments have become increasingly complex and may continue to grow more complex over the next year and a half as many of the organizations involved are set to increase the number of applications they deploy into the cloud.
According to Venafi’s vice-president for security strategy and threat intelligence Kevin Bocek, today’s online attackers have been in sync with the current shift to cloud computing. These are particularly keen on identity theft, especially of virtual identities as most cloud technologies require authenticated virtual or machine identities for secure communication. With attackers figuring out how to get around TLS certificates and similar measures, the risk of a security breach and operational disruption grows much higher.
The Venafi study likewise noted how responsibility for securing cloud-based apps is being assigned among internal teams, depending on each organization’s specific needs. For the most part, enterprise security teams were noted as the most likely to manage app security in the cloud, with cloud infrastructure teams running a close second.
However, the Venafi team also noted that while security teams want to collaborate and share the responsibility of protecting the integrity of cloud assets with developers, the former are usually left out of any decision-making processes. As a result, developers tend to make security-centric decisions without consulting those more knowledgeable about them, leading to security incidents that could have been prevented in the first place.
Higher-risk Deployment
Security incidents occurring during runtime were noted to be the most common issue encountered by participating organizations, accounting for 34% of the total incidents reported. Unauthorized access and app misconfiguration were also noted among the top incidents, along with previously unresolved incidents and failed audits.
Meanwhile, primary security concerns that security decision-makers (SDMs) have noted about moving apps to the cloud include the hijacking of accounts and services, coupled with the diversion of site traffic; malware and ransomware; as well as privacy or data access issues, especially those from GDPR. Nation-state attacks, particularly from hostile nations like North Korea, have also raised SDMs’ concerns.
