Organisations are racing to embrace cloud technologies for their myriad benefits. Be it private, public or a hybrid approach, the cloud offers organisations scalability, flexibility and freedom for employees to work wherever, whenever. When you add that to the promise of cost savings combined with enhanced collaboration, the cloud is a compelling proposition.
While the intention to expand cloud systems is evident among IT leaders, the alarming occurrence of breaches and the identified risks, such as third-party providers in supply chains, underscores the urgent need for organisations to prioritise cloud security. According to Tenabel’s latest cloud security report, 2024 Cloud Security Outlook: Navigating Barriers and Setting Priorities, 33% of respondents stated that they believe one of the biggest risks to their cloud infrastructure now sits outside of the organisation in the form of third-party suppliers.
Strong cyber practices are about exposing and closing cyber risk:
- Know their weaknesses: Gaining an all-inclusive view of cyber risk that uncovers the truth about deadly gaps across all assets and attack pathways.
- Expose their risk: Identifying, understanding and quantifying the cyber weaknesses with the greatest potential to erode their enterprise’s value, reputation and trust.
- Close their gaps: Taking swift action to eradicate priority cyber exposures anywhere to reduce business risk everywhere.
The cloud challenge
It is widely recognised that cloud adoption increases an organisation’s attack surface. A “toxic cloud trilogy” is defined as any cloud workload having three risk factors: a critical vulnerability; excessive permissions; with public exposure. This increases risk by making the workload’s weaknesses easier for attackers to exploit — and making the scope of exploitation potentially greater. Worryingly, according to Tenable’s Cloud Security Outlook report, 38% of organisations have the “toxic cloud trilogy” within their environments.
Digging deeper, most organisations (84.2%) possess unused or longstanding access keys with critical or high severity excessive permissions. Additionally, 23% of cloud identities, both human and non-human — including Amazon Web Services, Google Cloud Platform and Microsoft Azure, had critical or high severity excessive permissions. And 74% of organisations have publicly exposed storage assets, including those in which sensitive data resides. This exposure, often due to unnecessary or excessive permissions, has been linked to increased ransomware attacks.
Even cloud-native organisations grapple with the difficulty of detecting and remediating risk in their cloud environments:
- Cloud is complex with moving parts – virtual machines, containers, Kubernetes, serverless, data, networks and identities – including people and machines. And all distributed across multiple providers. According to IDC, having two cloud environments does not double the complexity, but in fact quadruples it.
- Organisations often struggle to monitor interactions or access events, which can be defined as any request by a human or a machine to access a file or a resource for a certain purpose.
- Identities, in particular, are a core threat given they are the keys to accessing cloud resources. If compromised, they allow attackers to gain access to everything, particularly sensitive data and systems. Ensuring credentials are kept private is paramount.
- Due to shorter build times and faster release cycles achieved through the use of DevOps tools, reorganising permissions across identities and entities every time new code is deployed is a challenge.
Taking cloud control
To address the risk, organisations must address the “toxic cloud trilogy” of cloud workloads that are critically vulnerable, highly privileged and publicly exposed.
- Step one is a complete and holistic visibility of the entire infrastructure — including unknown assets, cloud resources, code weaknesses, exploited vulnerabilities and user entitlement systems.
- Step two is to analyse all identities dynamically, enabling teams to identify access risk and excessive permissions.
- External exposure is a double-edged sword — necessary for doing business and a potential source of exposure. Step three is to rein in and monitor assets configured as public.
The ability to quickly analyse which systems contain a vulnerability, which users interact with that system, what data is stored there and whether or not it’s publicly accessible will enable prioritisation of those vulnerabilities which represent the greatest risk to the organisation.
This intelligence empowers the security team to address actual versus theoretical risk to strengthen defences and prevent threat actors gaining a toehold in the network but, more importantly, stop them crawling through the infrastructure if they do get in.
How AI can help
Gaining this broad visibility can be difficult, challenging security teams to conduct analysis, interpret the findings and identify what steps to take to reduce risk as quickly as possible. AI has the potential to address this. It can be used by cybersecurity professionals to search for patterns, explain what they’re finding in the simplest language possible and decide what actions to take to reduce cyber risk.
AI is being harnessed by defenders to power preventative security solutions that cut through complexity to provide the concise guidance defenders need to stay ahead of attackers and prevent successful attacks. Harnessing the power of AI allows security teams to work faster, search faster, analyse faster and ultimately make decisions faster.
Knowing the adversary means organisations can anticipate cyberattacks, ensuring they are best positioned to defend against today’s emerging threats. Hackers looking for low-hanging fruit will target smaller organisations whose security practices may be less mature.
Organisations must bolster their cloud security strategies and invest in the necessary expertise to safeguard their digital assets effectively, especially as IT managers expand their infrastructure and move more assets into cloud environments. Raising the security bar should persuade threat actors to move on and find another target.
- The author, Bernard Montel, is Europe, Middle East and Africa technical director and security strategist at Tenable
- Read more articles by Tenable on TechCentral
- This promoted content was paid for by the party concerned
Don’t miss:
TCS+ | Beware the Toxic Cloud Trilogy – a discussion with Tenable