Top Threat #7 to Cloud Computing: System Vulnerabilities
Blog Article Published: 11/06/2022
Written by the CSA Top Threats Working Group.
The CSA Top Threats to Cloud Computing Pandemic Eleven report aims to raise awareness of threats, vulnerabilities, and risks in the cloud. The latest report highlights the Pandemic Eleven top threats, in which the pandemic and the complexity of workloads, supply chains, and new technologies shifted the cloud security landscape.
This blog summarizes the seventh threat (of eleven) from the report: insecure software development. Learn more about threat #5 here and threat #6 here.
The Significance of System Vulnerabilities
System vulnerabilities are flaws in cloud service platforms. When exploited, they compromise confidentiality, integrity, and availability of data, disrupting service operations. All components of cloud platforms can contain vulnerabilities that leave the services open to attack. Implementing security practices that align with the below vulnerability categories is essential to your risk management.
Four Main Categories of System Vulnerabilities
1. Zero-day vulnerabilities
Newly discovered vulnerabilities for which patches don’t exist. Hackers can exploit vulnerabilities like these because there is nothing to stop them until patches are deployed.
2. Missing security patches
Over time, newer system vulnerabilities will be discovered and patches made available. As the number of unpatched vulnerabilities increases, so does the overall system security risk.
3. Configuration-based vulnerabilities
This arises when a system is deployed with default or misconfigured settings. Examples include using legacy security protocols, weak encryption ciphers, and weak permissions.
4. Weak or default credentials
The lack of strong authentication credentials provides potential attackers easy access to system resources and data. Passwords must be stored securely.
Business Impact
System vulnerabilities result in successful data breaches. Here are just a few of the business impacts of data breaches:
- Business can be disrupted, preventing customers from using the company’s services.
- Acquiring new customers may be harder, as the company is no longer trusted.
- There is a high average cost per incident.
What Are the Key Takeaways?
Here are some key takeaways to consider:
- System vulnerabilities frequently are flaws introduced through human error, making it easier for hackers to attack.
- Post Incident Response is costly. Losing company data negatively impacts the bottom line in revenue and reputation.
- Security risks due to vulnerabilities can easily be minimized through routine vulnerability detection and patch deployment combined with IAM practices.
Example
In August 2021, security researchers at cloud security company Wiz disclosed that they gained complete access to the data of several thousand Microsoft Azure customers. The vulnerabilities in Azure’s CosmosDB allowed users to download, delete, and manipulate data without user credentials.
Learn more about this threat and the other 10 top threats in our Top Threats to Cloud Computing Pandemic Eleven publication.
Trending This Week
#1 The 5 SOC 2 Trust Services Criteria Explained
#2 What You Need to Know About the Daixin Team Ransomware Group
#3 Mitigating Security Risks in Retrieval Augmented Generation (RAG) LLM Applications
#4 Cybersecurity 101: 10 Types of Cyber Attacks to Know
#5 Detecting and Mitigating NTLM Relay Attacks Targeting Microsoft Domain Controllers
Related Articles:
How DSPM Can Help Solve Healthcare Cybersecurity Attacks
Published: 04/30/2024
Considerations When Including AI Implementations in Penetration Testing
Published: 04/30/2024
Five Reasons Why Ransomware Still Reigns
Published: 04/29/2024
Why Business Risk Should be Your Guiding North Star for Remediation
Published: 04/25/2024