Download Publication

Home

Publications

Top Threats to Cloud Computing: Pandemic 11 Deep Dive

Who it's for:

Cloud security practitioners and enthusiasts
Compliance, risk, and technology staff
Executive management

Top Threats to Cloud Computing: Pandemic 11 Deep Dive

Release Date: 10/17/2023

Working Group: Top Threats

This publication reflects on eight recent cloud breach cases, presented as both a detailed narrative and a threat model. The threat model format provides an attack-style synopsis of the threat actor including the relevant cloud computing vulnerabilities, business and technical impacts, and end controls and mitigations, deriving actionable insights to benefit cloud users, builders, and defenders. Additionally, each of the cases is mapped to the cloud security threats outlined in the Top Threats to Cloud Computing Pandemic Eleven publication released in 2022, as well as applicable Cloud Controls Matrix (CCM) controls and key takeaways.

The analysis of these breaches produced observations on the prevalence of modern cloud security risks, the growing impact of identity and supply chain on cloud security, and the changing profile of threat actors targeting cloud services. Security practitioners and technology leaders are encouraged to use these breach case studies and insights to start their own internal analysis, comparisons, and discussions.

Breaches Covered:

Okta (2022)
Dropbox (2022)
US Department of Defense (2023)
Uber (2022)
Minecraft Log4j (2022)
Codecov (2021)
Portuguese & Brazilian Embassies - APT29 (2022)
LastPass (2022)

Download this Resource

Bookmark

Related resources

Related Resources

Natural Disasters: A Perfect Storm for Data Breaches

Published: 12/11/2023

Why Cloud-Forward Tech Teams Need to Abandon Traditional IAM and PAM

Published: 12/11/2023

A Recap of Recent Cybersecurity Incidents at Universities

Published: 12/07/2023

Why CISOs Are Investing in AI-Native Cybersecurity

Published: 12/06/2023

View all blogs

View all webinars

Acknowledgements

Jon-Michael Brook

Jon-Michael Brook

Jon-Michael C. Brook, Principal at Guide Holdings, LLC, has 20 years of experience in Information Security with such organizations as Raytheon, Northrop Grumman, Booz Allen Hamilton, Optiv Security and Symantec. Mr. Brook's work traverses the government, financial, healthcare, gaming, oil and gas and pharmaceutical industries. Mr. Brook obtained a number of industry certifications, including CISSP and CCSK, has patents and trade secrets in...

Alexander Getsin

Alexander Getsin

Alexander Stone Getsin is a financial technologies security leader with particular expertise and interest in cloud security, secure application design, and security governance. Alex is the lead author of industry security best practices, particularly with the Cloud Security Alliance, Top Threats research group, and the (ISC)2 Israeli Chapter, which he helps champion as a co-chairman. Alex leverages a decade of experience in finance, militar...