Today we will talk about the threats to cloud security, looking at the top-12 faced by certain organizations that use cloud services. As you know, the number of cloud migrations is growing every year, and security remains a serious topic.
- Threat 1: Data leakage
- Threat 2: Compromising accounts and bypassing authentication
- Threat 3: Hacking Interfaces and APIs
- Threat 4: The vulnerability of the systems used
- Threat 5: Account theft
- Threat 6: Insiders
- Threat 7: Targeted cyberattacks
- Threat 8: Permanent Data Loss
- Threat 9: Lack of awareness
- Threat 10: Abuse of cloud services
- Threat 11: DDoS attacks
- Threat 12: Joint Technologies, Common Risks
Threat 1: Data leakage
The cloud is exposed to the same threats as traditional infrastructure. Because of the large amount of data often transferred to the cloud today, cloud hosting platforms are becoming an attractive target for attackers. Simultaneously, the seriousness of potential threats depends on the importance and importance of stored data. Disclosure of personal user information is generally less-publicized than disclosure of medical opinions, trade secrets, intellectual property, which causes significant damage to an individual company’s reputation. When the data is leaked, the organization expects fines, lawsuits, criminal charges, and indirect components in the form of damage to the brand and losses to the business, which lead to irreversible consequences and lengthy procedures to restore the company’s image. That’s why cloud providers are trying to ensure that data is monitored and protected in a cloud environment. To minimize the risks and threats of data leakage, CSA recommends multi-factor authentication and encryption.
Threat 2: Compromising accounts and bypassing authentication
Data leakage is often the result of negligence in authentication mechanisms, where weak passwords are used, and encryption keys and certificates are mismanaged. Also, organizations face rights and permit management problems, where end users are assigned much more power than is necessary. The problem also occurs when the user is transferred to another position or resigns. Few people are in a hurry to update the powers according to the new roles of the user. As a result, the account contains many more features than required. And this is a bottleneck in the security issue.
Few facts: The biggest data breach in the first half of 2015 was an attack to steal Anthem Insurance customers’ identities. The attack was rated at 10 points on the Criticality Index, where more than 80 million accounts were compromised, accounting for one-third of the total number of data stolen in the first half of 2015.
CSA recommends using multi-factor authentication mechanisms, including disposable passwords, tokens, smart cards, USB keys. This will protect cloud services, as the use of voiced methods complicates the process of password compromising.
Threat 3: Hacking Interfaces and APIs
Today, cloud services and applications are unthinkable without a user interface. The mechanisms of access control and encryption in the API are worked out depending on the security and availability of cloud services. When interacting with a third party using its API interfaces, the risks increase significantly. Why? Because you need to provide additional information, up to the user’s login and password. Security-weak interfaces are becoming a bottleneck in matters of accessibility, privacy, integrity, and security. The CSA recommends that access controls be adequately monitored and that threats be protected and detected early. The ability to simulate threats and find solutions to repel them is worthy of prevention against hacking. Also, the CSA recommends that you do code security checks and run penetration tests.
Threat 4: The vulnerability of the systems used
The vulnerability of the systems used is a problem that is found in multi-tenant cloud environments. Fortunately, it is minimized by the right IT management methods, the CSA notes. Best practices include regular vulnerability scanning, the latest patches, and a quick response to security threats reports. According to CSA reports, the costs spent on reducing system vulnerabilities are lower than other IT costs. A common error is when using cloud solutions in the IaaS model, companies don’t pay enough attention to the security of their applications that are placed in the cloud providers’ secure infrastructure. And the vulnerability of the apps themselves is becoming a bottleneck in the security of the corporate infrastructure.
Threat 5: Account theft
Phishing, fraud, exploits are also found in the cloud. Threats are added in the form of attempts to manipulate transactions and change data. Attackers consider cloud sites as a field for the attack. And even a “deep-in-depth” strategy may not be sufficient. You need to ban the “sharing” of user accounts and services among themselves and pay attention to multi-factor authentication mechanisms. Service accounts and user accounts need to be monitored by tracking transactions in detail. The main thing is to protect your accounts from theft, CSA recommends.
Threat 6: Insiders
An insider threat may come from current or former employees, system administrators, contractors, or business partners. Insiders- attackers pursue different goals, ranging from data theft to the desire to take revenge. In the case of the cloud, the goal may be to completely or partially destroy the infrastructure, gain access to data, and so on. Systems that are directly dependent on cloud provider security are a big risk. CSA recommends taking care of encryption mechanisms and taking control of encryption keys. Don’t forget about logging, monitoring, and auditing events on individual accounts.
Threat 7: Targeted cyberattacks
A sustained threat, or targeted cyberattack, is not uncommon nowadays. With sufficient knowledge and a set of appropriate tools, you can achieve results. An attacker set to establish and consolidate his presence in the target infrastructure is not easily detected. Cloud service providers use advanced security tools to minimize risks and prevent such threats. But beyond modern solutions, it requires an understanding of the nature and nature of this type of attack. CSA recommends specialized training of officers to recognize intruder techniques, to use advanced security tools, to be able to manage processes properly, to be aware of the planned response to incidents, to use preventive methods that improve the security of the infrastructure.
Threat 8: Permanent Data Loss
Because the clouds have become mature enough, data loss cases without the ability to recover because of the service provider are sporadic. Simultaneously, the attackers, aware of the consequences of permanent data removal, aim to commit such destructive actions. Cloud hosting providers recommend separating user data from application data while storing it in different locations. Do not forget about effective methods of backup. Daily backup and backup storage on external alternative secure sites are essential for cloud environments. Also, if a customer encrypts data before being placed in the cloud, you should take care of the security of storing encryption keys in advance. As soon as they fall into the hands of the attacker, they become available and the data themselves, the loss of which can be the cause of serious consequences.
Threat 9: Lack of awareness
Organizations that move to the cloud without understanding cloud capabilities face risks. If, for example, the client’s development team is not familiar enough with the features of the cloud and the principles of cloud application deployment, operational and architectural problems arise. CSA reminds you to understand the way the service provider has been operating. This will help answer the risks the company takes by entering into a contract with a hosting provider.
Threat 10: Abuse of cloud services
Clouds can be used by legitimate and illegitimate organizations. The latter’s goal is to use cloud resources to commit malicious activities: launching DDoS attacks, sending spam, distributing malicious content, etc.
Threat 11: DDoS attacks
Although DoS attacks have a long history, the development of cloud technologies has made them more common. As a result of DoS attacks, services that are important for the company’s business may be slowed down or stopped altogether. It is known that DoS attacks consume a large amount of computing power for the use of which the client will pay. Although the DoS attacks’ principles are, at first glance, simple, you need to understand their features at the application level: they target vulnerabilities in web servers and databases. Cloud providers are certainly better at dealing with DoS attacks than individual customers. The main thing is to have a plan to mitigate the attack before it happens.
Threat 12: Joint Technologies, Common Risks
Vulnerabilities in the technologies used are a sufficient threat to the cloud. Cloud service providers provide virtual infrastructure and cloud applications, but it affects the entire environment if a vulnerability occurs at one level. CSA recommends using a “security in depth” strategy, implementing multi-factor authentication mechanisms, intrusion detection systems, adherence to the concept of network segmentation, and the principle of least privilege.
