By Sharon Shea
Before jumping feet-first into the cloud, understand the new and continuing top cloud security challenges your organization is likely to face — and how to mitigate them.
All the major promises of the cloud — improved IT efficiency, flexibility and scalability — come with one major challenge: security.
Many organizations can’t delineate where cloud service provider (CSP) responsibilities end and their own responsibilities begin, opening them to numerous vulnerabilities. The increased expansiveness of the cloud also increases an organization’s potential attack surface. To further complicate the matter, traditional security controls often don’t fulfill cloud security needs.
To help companies understand the cloud challenges they’re up against, the Cloud Security Alliance (CSA) went directly to the professionals. A working group of practitioners, architects, developers and C-level staff identified a list of about 25 security threats, which were then analyzed by security professionals who ranked them and narrowed them down further to the 11 most common cloud security challenges:
A far as what made this year’s list, here are the top 11 threats — listed in order of severity, according to survey respondents — along with mitigations for each.
- Data breaches
A responsibility of both CSPs and their customers, data breaches remained the top cloud security threat yet again this year in CSA’s report. A number of data breaches have been attributed to the cloud over the past years, one of the most notable being Capital One’s cloud misconfigurations.
- Misconfigurations and inadequate change control
When assets are set up incorrectly, they are vulnerable to attack. For example, the Capital One breach was traced back to a web application firewall misconfiguration that exposed Amazon S3 buckets. In addition to insecure storage, excessive permissions and the use of default credentials are two other major sources of vulnerabilities.
- Lack of cloud security architecture and strategy
Too many organizations jump into the cloud without the proper architecture and strategy in place. Prior to making the leap to the cloud, customers must understand the threats they are exposed to, how to migrate to the cloud securely — note, it’s not a lift-and-shift process — and the ins and outs of the shared responsibility model.
- Insufficient identity, credential, access and key management
A majority of cloud security threats — and cybersecurity threats in general — can be linked to identity and access management (IAM) issues. According to CSA guidance, this stems from the following:
- Account hijacking
Cloud account hijacking is the disclosure, accidental leakage, exposure or other compromise of a cloud account that is critical to the operation, administration or maintenance of a cloud environment. These highly privileged and sensitive accounts, if breached, can cause massive consequences.
- Insider threats
The risks associated with employees and others working within an organization’s network are not limited to the cloud. Whether negligent or intentional, insiders — including current and former employees, contractors and partners — can cause data loss, system downtime, reduced customer confidence and data breaches.
- Insecure interfaces and APIs
CSP UIs and APIs through which customers interact with cloud services are some of the most exposed components of a cloud environment. The security of any cloud service starts with how well these are safeguarded and is the responsibility of both customers and CSPs.
- Weak control plane
A responsibility of the customer and new to the list this year, the cloud control plane is the collection of cloud administrative consoles and interfaces used by an organization. It also includes data duplication, migration and storage, according to CSA. Improperly secured, a breached control plane could cause data loss, regulatory fines and other consequences, as well as a tarnished brand reputation that could lead to revenue loss.
- Metastructure and applistructure failures
The metastructure, defined by CSA, is “the protocols and mechanisms that provide the interface between the infrastructure layer and other layers” — in other words, “the glue that ties the technologies and enables management and configuration.”
- Limited cloud usage visibility
Cloud visibility has long been a concern of enterprise admins, but it is new to the CSA cloud security challenges list this report. Limited visibility results in two key challenges, according to CSA:
- Abuse and nefarious use of cloud services
Just as the cloud can be used for good, it can also be used maliciously by threat actors. Nefarious use of legitimate SaaS, PaaS and IaaS offerings affects individuals, cloud customers and CSPs alike. Disguised as coming from a CSP, customers are especially vulnerable to the misuse of cloud services via the following: