The popularity and adoption of new technologies such as cloud workloads, supply chains, edge computing, the Internet of Things (IoT), and blockchain have changed the security landscape for cloud computing applications. In order to improve the awareness of threats, vulnerabilities and risks in the cloud, the International Cloud Security Alliance (CSA) recently launched a study on the application security issues in the current cloud computing field. More than 700 cloud computing technology industry experts were surveyed, and compiled and released the "Cloud Computing Top Threat Report". According to the report, the following 11 security challenges are emerging as key threats to cloud computing adoption.
Threat 1
Identity, credentials, access rights
And key mismanagement
The identity, credentials, and access management system generally contains various tools and policies that allow organizations to manage, monitor, and protect users' access to key resources, such as electronic files, computer systems, and physical resources, such as server rooms or buildings. In this process, it is critical to properly maintain and continuously monitor identity, credentials, and access management systems. The use of risk scores in Identity and Access Management (IAM) enhances security posture. Using a clear risk allocation model, continuous monitoring, and appropriate behavioral isolation and segmentation helps cross-check the IAM system.
Business impact
Poor management of identity, credentials, access rights, and keys may result in the following negative consequences:
• Lack of compliance with business system access and indifference to network security;
• Critical business data is replaced or corrupted, making data leakage from unauthorized or malicious users difficult to detect;
• Loss of user trust and business revenue;
• Additional financial costs due to serious security incident response and forensics;
• Ransomware attacks and supply chain disruptions.
Security incidents
From January to July 2019, Capital One Bank experienced a massive data breach, which was caused by Capital One executing arbitrary user-initiated requests on its servers in its AWS accounts. An attacker can use a server placed on the public network to access the server on the Intranet, causing command execution and data leakage.
Key points of protection
• Use multi-factor authentication;
• Use strict access controls for cloud users and identities, especially restricting the use of root accounts;
• Segregate and segment accounts based on business needs and the principle of least privilege;
• Using a programmatic, centralized method to rotate keys;
• Timely deletion of unused credentials and access privileges.
Threat 2
Unsafe interfaces and apis
Organizations are accelerating API adoption in order to provide better digital experiences for third-party developers and customers. But as apis become more popular, it becomes critical to secure those interfaces. Apis and microservices must be checked for vulnerabilities due to misconfiguration, poor coding practices, lack of authentication, and improper authorization. These vulnerabilities can leave interfaces vulnerable to attack.
Misconfiguration of apis and other interfaces is a major cause of security events and data leaks. Common problems include: unauthenticated endpoints; Weak authentication; Too much authority; Disable standard safety controls; The system is not patched. Logic design problem; Disable logging or monitoring. These problems may result in resource leakage, deletion or modification, data adjustment or service interruption, etc.
Business impact
The business impact of apis and insecure interfaces is primarily the accidental exposure of sensitive or private data, and the severity of such risks depends on how the API is used and how quickly vulnerabilities are detected and mitigated.
Security incidents
On May 5, 2021, Peloton revealed an API vulnerability that exposed Peloton customer personally identifiable information (PII) through weak user authentication and object-level authorization. The data includes detailed age, gender, city, weight, exercise statistics and even information such as birthdays that have been made private on the profile Settings page.
Key points of protection
• Track, configure, and protect apI-related attack surfaces;
• Update traditional control and change management strategies and methods to keep pace with the growth and changing trends of cloud-based apis;
• Automate to continuously monitor abnormal API traffic and fix vulnerabilities in near real time;
• Consider adopting an open API framework, such as the Open Cloud Computing Interface (OCCI) or Cloud Infrastructure Management Interface (CIMI).
Threat 3
Misconfiguration and inadequate change control
Misconfiguration is when calculated assets are incorrectly or improperly set up, making them vulnerable to accidental damage or malicious activity. Common misconfigurations include: insecure data store elements or containers; Too much authority; Leave the default credentials and configuration Settings unchanged; Disable standard safety controls; The system is not patched. Disable logging or monitoring. Unrestricted access to ports and services; The unsafe management of secrets; Improper configuration or lack of configuration verification. Cloud resource configuration errors are the main cause of data leakage, which may lead to resource deletion or modification and service interruption.
Improper change control in a cloud environment can lead to misconfiguration and hinder the repair of misconfiguration. Cloud environments and cloud computing approaches differ from traditional information technology (IT) in that they make change more difficult to control. The traditional change process involves multiple roles and permissions, so it can take days or weeks to put into operation. Cloud computing relies on automation, role extension, and access to support rapid change, which makes it difficult to control change. In addition, using multiple cloud providers adds complexity, with each provider's unique capabilities being enhanced and expanded almost daily. This dynamic environment requires an agile and proactive approach to change control and repair.
Business impact
The impacts of incorrect configuration and inadequate change control include:
• Data disclosure affects confidentiality;
• Data loss affects availability;
• Data corruption affects integrity;
• System performance affects operational efficiency;
• System outages affect operational sustainability;
• Ransoms have financial implications;
• Compliance and financial implications of violations and fines;
• Loss of revenue;
• Share price falls;
• Company reputation impact.
Security incidents
On January 7, 2021, Microsoft misconfigured the Microsoft Azure Blob (cloud) bucket, which houses a large amount of third-party data, and publicly disclosed more than 100 corporate "teasers" and source code that wanted to work with Microsoft.
Key points of protection
• Enterprises need to adopt available technologies that continuously scan misconfigured resources to fix vulnerabilities in real time;
• A change management approach must be able to reflect the dynamic nature of business transformation and security challenges to ensure that changes are properly approved using real-time automated validation.
Threat 4
Lack of cloud security architecture and strategy
Cloud security policies and architectures include consideration and selection of cloud deployment models, cloud service models, cloud service providers (CSPS), service area availability, specific cloud services, and general principles. In addition, IAM's forward-looking design, network and security controls across different cloud accounts, vendors, services and environments are also covered. Strategic considerations should precede and guide architectural design, but cloud challenges often require an incremental and agile planning approach. If cloud computing is to be successful and secure, security concerns and risks cannot be ignored. Industry breaches show that a lack of such planning can leave cloud environments and applications unable (or ineffective) to defend against cyber attacks.
Business impact
The lack of a cloud security strategy and architecture limits the feasibility of effective enterprise and infrastructure security architecture implementation. Without these security/compliance goals, cloud computing cannot succeed and can even result in fines and other penalties for violations, or significant costs due to improper refactoring and migration.
Security incidents
Bonobos, a US clothing store owned by Walmart, suffered a massive data breach in January 2021 that exposed the personal information of millions of customers, including addresses, phone numbers, some credit card numbers and orders placed on its website. This happens because the external cloud backup service hosting the backup files is compromised.
Key points of protection
• Enterprises should consider business objectives, risks, security threats and legal compliance in cloud services and infrastructure design and decisions;
• Following cloud services and infrastructure security design principles is even more important for development given the rapid pace of change and limited centralized control of the cloud environment;
• Consider due diligence and third-party vendor security assessments as fundamental practices and complement threat modeling, security design and integration.
Threat 5
Unsafe software development
Software systems are complex, and cloud technologies tend to add to that complexity, increasing the potential for exploit and misconfiguration. While developers do not intend to create insecure software, major software vendors issue monthly patches to fix code bugs that affect system confidentiality, integrity, and/or availability. While not all software bugs are a security risk, as history has shown, even minor errors can become major threats.
Business impact
The possible effects of insecure software development include:
• Customers lose confidence in the product or solution;
• Damage to brand reputation due to data breaches;
• Legal and financial implications of litigation.
Security incidents
On September 13, 2021, researchers discovered that AppleiOS was being exploited by NSO's Pegasus software involving a zero-click vulnerability that allowed code to be executed remotely.
Key points of protection
• Using cloud technologies to enable developers to focus on business-specific issues;
• Projects such as fixes can be owned by the cloud service provider (CSP) rather than the enterprise by using the shared liability model;
• CSP focuses on security and will provide guidance on how to implement services in a secure manner, such as AWS Well-architected Framework or secure design pattern.
Threat 6
Insecure supply chain systems
In the rapidly growing reality of cloud computing, third-party resources can mean different things: from open source to SaaS product and API risks, all the way to hosted services provided by cloud providers. Risks from third-party sources are also considered "supply chain vulnerabilities" because they are part of the process by which a business delivers its product or service. Cybercriminals have increasingly exploited these vulnerabilities in recent years, as reliance on third-party supply chain services has grown. Studies show that two-thirds of violations are caused by vendor or third-party vulnerabilities.
Business impact
The possible impacts of an insecure supply chain system include:
• Loss or interruption of critical business processes on the cloud;
• Cloud service data is accessed by external users;
• Patching or fixing security issues depends on the provider and how quickly it responds, and requires constant updates to internal applications and products. The impact on the business can be critical, depending on how important vulnerable components are to the application.
Security incidents
Between May 2019 and August 2021, Volkswagen Group's North American subsidiary suffered a data breach caused by a supplier that placed storage services in an unprotected state between May 2019 and August 2021. The breach involved 3.3 million customers, including personally identifiable information (PII) and more sensitive financial data for some customers.
Key points of protection
• While companies cannot prevent bugs in code or products they did not create, they can try to make good decisions about which products to use, such as looking for officially supported products and those that have compliance certification, bug bounty programs, and security bulletins and quick fixes;
• Identify and track third parties that the enterprise is using, including open source, SaaS products, cloud providers and hosted services, as well as other integrations that may have been added to applications;
• Review third-party resources regularly. If you find unwanted products, remove them and revoke permissions that may have been granted to them (such as any access to the code repository, infrastructure, or application);
• Don't be the weak link. Penetration testing of enterprise applications where applicable, introducing developers to secure coding practices, and using static application Security Testing (SAST) and dynamic application Security Testing (DAST) solutions.
Threat 7
System vulnerabilities
System vulnerability is also a common defect in cloud service platforms. Attackers may use them to compromise the confidentiality, integrity, and availability of data, thereby disrupting service operations. It is important to note that all components may contain vulnerabilities that make cloud services vulnerable. These system vulnerabilities fall into four main categories:
• Zero-day vulnerabilities -- newly discovered vulnerabilities for which no patch has been developed. Hackers are quick to exploit these vulnerabilities because there is nothing to stop them until a patch is deployed. The Log4Shell discovered earlier is a typical example of a zero-day vulnerability.
• Lack of security patches -- Overall system security risks increase as the number of unpatched vulnerabilities increases, so deploying patches with known critical vulnerabilities as soon as they become available can reduce the attack surface of a system.
• Configuration-based vulnerability -- this vulnerability occurs when a system is deployed with default or misconfigured Settings. Examples of configuration-based vulnerabilities include the use of legacy security protocols, weakly encrypted passwords, weak permissions, and poorly protected system administration interfaces. In addition, running unnecessary services on the system is another configuration-related issue.
• Weak authentication or default credentials -- The lack of strong authentication credentials allows potential attackers to easily access system resources and associated data. Similarly, passwords that are not securely stored can be stolen and used by hackers to break into systems.
Business impact
Cloud computing system vulnerabilities may have the following impacts on services:
• Many data breaches are caused by system vulnerabilities;
• When a data breach occurs, enterprise business may be interrupted, thus affecting customers' use of enterprise services;
• Additional technical costs associated with dealing with issues such as data breaches.
Security incidents
In December 2021, a Log4Shell (CVE-2021-45046) remote code vulnerability outbreak affected version 2.0beta9-2.14.1 of the Java-based Log4j logging tool. Given the widespread use of Java in cloud systems, Log4Shell is a serious threat. An attacker can exploit Log4Shell by submitting a malicious request to a vulnerable system that causes the system to execute arbitrary code, allowing the attacker to steal information, launch ransomware, or take over control of the system.
Key points of protection
• System vulnerability is a defect in system components, usually introduced by human error, which makes it easier for hackers to attack enterprise cloud services. Therefore, it is crucial to strengthen the "human" factor. Enterprises can carry out security training and education regularly;
• Security risks caused by system vulnerabilities can be greatly reduced through routine vulnerability detection and patch deployment and strict IAM practices.
Threat to eight
Accidental leakage of cloud computing data
Cloud services enable businesses to build, innovate, and expand faster than ever before.
No comments