Top Threat #7 to Cloud Computing: System Vulnerabilities

Written by the CSA Top Threats Working Group.

The CSA Top Threats to Cloud Computing Pandemic Eleven report aims to raise awareness of threats, vulnerabilities, and risks in the cloud. The latest report highlights the Pandemic Eleven top threats, in which the pandemic and the complexity of workloads, supply chains, and new technologies shifted the cloud security landscape.

This blog summarizes the seventh threat (of eleven) from the report: insecure software development. Learn more about threat #5 here and threat #6 here.

The Significance of System Vulnerabilities

System vulnerabilities are flaws in cloud service platforms. When exploited, they compromise confidentiality, integrity, and availability of data, disrupting service operations. All components of cloud platforms can contain vulnerabilities that leave the services open to attack. Implementing security practices that align with the below vulnerability categories is essential to your risk management.

Four Main Categories of System Vulnerabilities

1. Zero-day vulnerabilities

Newly discovered vulnerabilities for which patches don’t exist. Hackers can exploit vulnerabilities like these because there is nothing to stop them until patches are deployed.

2. Missing security patches

Over time, newer system vulnerabilities will be discovered and patches made available. As the number of unpatched vulnerabilities increases, so does the overall system security risk.

3. Configuration-based vulnerabilities

This arises when a system is deployed with default or misconfigured settings. Examples include using legacy security protocols, weak encryption ciphers, and weak permissions.

4. Weak or default credentials

The lack of strong authentication credentials provides potential attackers easy access to system resources and data. Passwords must be stored securely.

Business Impact

System vulnerabilities result in successful data breaches. Here are just a few of the business impacts of data breaches:

• Business can be disrupted, preventing customers from using the company’s services.
• Acquiring new customers may be harder, as the company is no longer trusted.
• There is a high average cost per incident.

What Are the Key Takeaways?

Here are some key takeaways to consider:

1. System vulnerabilities frequently are flaws introduced through human error, making it easier for hackers to attack.
2. Post Incident Response is costly. Losing company data negatively impacts the bottom line in revenue and reputation.
3. Security risks due to vulnerabilities can easily be minimized through routine vulnerability detection and patch deployment combined with IAM practices.

Example

In August 2021, security researchers at cloud security company Wiz disclosed that they gained complete access to the data of several thousand Microsoft Azure customers. The vulnerabilities in Azure’s CosmosDB allowed users to download, delete, and manipulate data without user credentials.

Learn more about this threat and the other 10 top threats in our Top Threats to Cloud Computing Pandemic Eleven publication.