Top Threats to Cloud Computing - Deep Dive 2025
Released: 04/28/2025
This report uses the threats identified in CSA’s Top Threats to Cloud Computing 2024 to reflect on eight recent cybersecurity breaches. Notable incidents covered include the Snowflake data breach (2024), CrowdStrike outage (2024), and Microsoft breach (2024).
The report presents each security incident as both a detailed narrative and a threat model. This includes an attack-style synopsis with the relevant cloud security risks, CCM controls, and mitigations. It also discusses the technical and business impacts of each case, as well as key metrics and takeaways.
Security practitioners should use the insights from these case studies to start their own internal analyses and discussions. They should draw on the recommendations to improve their organization's security and yield faster responses to critical threats.
Key Takeaways:
- Cloud security must account for human error and persistent threats by implementing continuous auditing and security automation
- Strong Identity and Access Management (IAM) practices, including MFA and least privilege access control, must be rigorously enforced
- Cloud providers and users must work together to secure their environments by implementing configuration management and security monitoring
- Anomaly detection and centralized logging are necessary to identify misconfigurations, unauthorized access, and malicious activities quickly
- Continuous monitoring of supply chain security is necessary, since threat actors tend to target supply chain risks
- Proactive cloud governance, such as maintaining secure configuration baselines, reduces long-term risk
- Traditional incident response plans fail to account for cloud complexity, leading to delayed detection and mitigation
- Many breaches originate from vulnerabilities in development and testing environments, where security controls are often weaker than in production
Best For:
- Cloud & IT security professionals
- Compliance & risk professionals
- Executive management
