Navigating Cloud Security Challenges: Key Concerns for Cybersecurity Professionals

Written by Scott Caveza, Tenable.

As organizations expand their use of public cloud and adopt a cloud-first strategy, cybersecurity teams encounter mounting complexity and new forms of risk. Cloud service providers (CSPs) often apply patches silently and fix misconfigurations without any notice. As a result, organizations lose visibility of their attack surface. They can’t rely on their traditional security controls and must trust what CSPs provide.

In this blog post, we will explore four critical areas of concern that cybersecurity professionals must address when it comes to cloud security. From transparency issues to data security, misconfigurations, and cloud vulnerability discoveries, understanding and mitigating these risks is crucial for organizations embracing the public cloud.

Transparency issues

CSPs often address vulnerabilities without notifying end users or providing proper documentation. This lack of transparency hinders risk assessment and poses challenges for infosec teams. The absence of release notes, security advisories and tracking identifiers makes it difficult to evaluate the security posture of a cloud provider. Additionally, incident response processes and evidence of exploitation are frequently undisclosed. The resulting blind spots create growing concerns for organizations. While tracking vulnerabilities in CSPs remains a topic of debate, no comprehensive solution exists today.

Data security

Despite CSPs offering best practices for securing data, breaches caused by unsecured or improperly secured cloud resources continue to occur. Examples include misconfigured and unsecured Azure endpoints at Microsoft, which potentially exposed business transaction data, and an unsecured Amazon Elasticsearch database compromising Amazon Prime user viewing data. Such incidents demonstrate that even major CSPs are not immune to configuration mistakes. In the Tenable 2022 Threat Landscape Report, our analysis of publicly reported breaches in 2022 revealed that over 3% of breaches resulted from unsecured databases, exposing more than 800 million records across various industries. Robust data security measures must be implemented by both CSPs and their customers to prevent unauthorized access and data leaks.

Misconfigurations reign supreme

Cloud configuration mistakes, particularly in platforms like Kubernetes, present significant risks. In a study from May 2022, the Shadowserver Foundation found that 84% of Kubernetes API instances were exposed to the internet, increasing the attack surface for potential threats. This doesn’t mean that each of these API instances was vulnerable, but it’s unlikely that there are valid reasons to have these APIs exposed, as malicious actors actively exploit unsecured Kubernetes APIs. To mitigate such risks, the U.S. National Security Agency (NSA) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) provide guidelines on Kubernetes hardening. In short, organizations must prioritize secure practices and implement best practices for their Kubernetes deployments to minimize the risk of exploitation.

Cloud vulnerability discoveries

Numerous cloud vulnerability discoveries have been reported by independent researchers, often without any official communication from CSPs. Lack of transparency regarding these vulnerabilities leaves cloud users unaware of their actual risk exposure. While some vulnerabilities receive CVEs or security advisories, others are silently fixed by CSPs. This lack of information makes it challenging for security professionals to evaluate and compare the security postures of different providers. As organizations increasingly rely on public cloud services, it is essential to proactively evaluate their own security practices and those of their CSPs. Without a true understanding of their risk exposure, organizations remain in the dark about the security of their cloud resources and their risk exposure.

Conclusion

As the adoption of public cloud services continues to grow, cybersecurity professionals face several critical challenges in ensuring the security of their organization's cloud deployments. As we discussed, transparency issues, data security, misconfigurations, and cloud vulnerability discoveries all demand attention and proactive measures. By understanding these concerns and implementing appropriate security practices, organizations can navigate the complexities of public cloud security and protect their valuable data and assets in the ever-evolving threat landscape of the cloud era.

To learn more about cloud security challenges, read the blog Reduce Your Exposure by Tackling Known Vulnerabilities, download Tenable’s 2022 Threat Landscape Report and read about Tenable’s vulnerability disclosures in Microsoft’s Azure Synapse Analytics.