Uncovering the CSA Top Threats to Cloud Computing with Jim Reavis

By Greg Jensen, Sr. Principal Director - Security Cloud Business Group, Oracle

For the few that attend this year’s BlackHat conference kicking off this week in Las Vegas, many will walk away with an in depth understanding and knowledge on risk as well as actionable understandings on how they can work to implement new strategies to defend against attacks. For the many others who don’t attend, Cloud Security Alliance has once again developed their CSA Top Threats to Cloud Computing: The Egregious 11.

I recently sat down with the CEO and founder of CSA, Jim Reavis, to gain a deeper understanding on what leaders and practitioners can learn from this year’s report that covers the top 11 threats to cloud computing - The Egregious 11.

(Greg) Jim, for those who have never seen this, what is the CSA Top Threats to Cloud report and who is your target reader?

(Jim) The CSA Top Threats to Cloud Computing is a research report that is periodically updated by our research team and working group of volunteers to identify high priority cloud security risks, threats and vulnerabilities to enable organizations to optimize risk management decisions related to securing their cloud usage. The Top Threats report is intended to be a companion to CSA's Security Guidance and Cloud Controls Matrix best practices documents by providing context around important threats in order to prioritize the deployment of security capabilities to the issues that really matter.

Our Top Threats research is compiled via industry surveys as well as through qualitative analysis from leading industry experts. This research is among CSA's most popular downloads and has spawned several translations and companion research documents that investigate cloud penetration testing and real world cloud incidents. Top Threats research is applicable to the security practitioner seeking to protect assets, executives needing to validate broader security strategies and any others wanting to understand how cloud threats may impact their organization. We make every effort to relate the potential pitfalls of cloud to practical steps that can be taken to mitigate these risks.

(Greg) Were there any findings in the Top Threats report that really stood out for you?

(Jim) Virtually all of the security issues we have articulated impact all different types of cloud. This is important as we find a lot of practitioners who may narrow their cloud security focus on either Infrastructure as a Service (IaaS) or Software as a Service (SaaS), depending upon their own responsibilities or biases. The cloud framework is a layered model, starting with physical infrastructure with layers of abstraction built on top of it. SaaS is essentially the business application layer built upon some form of IaaS, so the threats are applicable no matter what type of cloud one uses. Poor identity management practices, such as a failure to implement strong authentication, sticks out to me as a critical and eminently solvable issue. I think the increased velocity of the "on demand" characteristic of cloud finds its way into the threat of insufficient due diligence and problems of insecure APIs. The fastest way to implement cloud is to implement it securely the first time.

(Greg) What do you think are some of the overarching trends you've noticed throughout the last 3 iterations of the report?

(Jim) What has been consistent is that the highest impact threats are primarily the responsibility of the cloud user. To put a bit of nuance around this as the definition of a "cloud user" can be tricky, I like to think of this in three categories: a commercial SaaS provider, an enterprise building its own "private SaaS" applications on top of IaaS or a customer integrating a large number of SaaS applications have the bulk of the technical security responsibilities. So much of the real world threats that these cloud users grapple with are improper configuration, poor secure software development practices and insufficient identity and access management strategies.

(Greg) Are you seeing any trends that show there is increasing trust in cloud services, as well as the CSP working more effectively around Shared Responsibility Security Model?

(Jim) The market growth in cloud is a highly quantifiable indicator that cloud is becoming more trusted. "Cloud first" is a common policy we see for organizations evaluating new IT solutions, and it hasn't yet caused an explosion of cloud incidents, although I fear we must see an inevitable increase in breaches as it becomes the default platform.

We have been at this for over 10 years at CSA and have seen a lot of maturation in cloud during that time. One of the biggest contributions we have seen from the CSPs over that time is the amount of telemetry they make available to their customers. The amount and diversity of logfile information customers have today does not compare to the relative "blackbox" that existed when we started this journey more than a decade ago.

Going back to the layered model of cloud yet again, CSPs understand that most of the interesting applications customers build are a mashup of technologies. Sophisticated CSPs understand this shared responsibility for security and have doubled down on educational programs for customers. Also, I have to say that one of the most rewarding aspects of being in the security industry is observing the collegial nature among competing CSPs to share threat intelligence and best practices to improve the security of the entire cloud ecosystem.

One of the initiatives CSA developed that helps promulgate shared responsibility is the CSA Security, Trust, Assurance & Risk (STAR) Registry. We publish the answers CSPs provide to our assessment questionnaire so consumers can objectively evaluate a CSP's best practices and understand the line of demarcation and where their responsibility begins.

(Greg) How does the perception of threats, risks and vulnerabilities help to guide an organization’s decision making & strategy?

(Jim) This is an example of why it is so important to have a comprehensive body of knowledge of cloud security best practices and to be able to relate it to Top Threats. A practitioner must be able to evaluate using any risk management strategy for a given threat, e.g. risk avoidance, risk mitigation, risk acceptance, etc. If one understand the threats but not the best practices, one will almost always choose to avoid the risk, which may end up being a poor business decision. Although the security industry has gotten much better over the years, we still fight the reputation of being overly conservative and obstructing new business opportunities over concerns about security threats. While being paranoid has sometimes served us well, threat research should be one of a portfolio of tools that helps us embrace innovation.

(Greg) What are some of the security issues that are currently brewing/underrated that you think might become more relevant in the near future?

(Jim) I think it is important to understand that malicious attackers will take the easy route and if they can phish your cloud credentials, they won't need to leverage more sophisticated attacks. I don't spend a lot of time worrying about sophisticated CSP infrastructure attacks like the Rowhammer direct random access memory (DRAM) leaks, although a good security practitioner worries a little bit about everything. I try to think about fast moving technology areas that are manipulated by the customer, because there are far more customers than CSPs. For example, I get concerned about the billions of IoT devices that get hooked into the cloud and what kinds of security hardening they have. I also don't think we have done enough research into how blackhats can attack machine learning systems to avoid next generation security systems.

Our Israeli chapter recently published a fantastic research document on the 12 Most Critical Risks for Serverless Applications. Containerization and Serverless computing are very exciting developments and ultimately will improve security as they reduce the amount of resource management considerations for the developer and shrink the attack surface. However, these technologies may seem foreign to security practitioners used to a virtualized operating system and it is an open question how well our tools and legacy best practices address these areas.

The future will be a combination of old threats made new and exploiting fast moving new technology. CSA will continue to call them as we see them and try to educate the industry before these threats are fully realized.

(Greg) Jim, it’s been great hearing from you today on this new Top Threats to Cloud report. Hats off to the team and the contributors for this year’s report. Has been great working with them all!

(Jim) Thanks Greg! To learn more about this, or to download a copy of the report, visit us at www.cloudsecurityalliance.com