Cloud Security Alliance’s Top‌ ‌Threats‌ ‌to‌ ‌Cloud‌ ‌Computing:‌ Pandemic 11 Report Finds Traditional Cloud Security Issues Becoming Less Concerning

Study reveals shift in cloud security focus from information security to configuration and authentication

SEATTLE and RSA Conference (San Francisco) – June 7, 2022 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released Top Threats to Cloud Computing: The Pandemic 11. The report, the sixth in the Top Threats to Cloud Computing series, found a marked change in what cloud security provider (CSP) security issues are seen as concerning. New, more nuanced items, such as configuration and authentication, suggest both that consumers’ understanding of the cloud has matured, and signals a technology landscape where consumers are actively considering cloud migration.

Respondents indicated topics such as control plane weaknesses, metastructure (i.e., mechanisms that provide the interface between the infrastructure and other layers) and applistructure (applications deployed in the cloud and the services used to build them) failures, and limited cloud visibility as top concerns – a marked departure from more generic threats, risks, and vulnerabilities (i.e. data loss, denial of service) that featured more strongly in previous Top Threats reports. Other top threats in this year’s survey highlight lack-of-control type hurdles that users may experience with CSPs, such as limited cloud usage visibility and a weak control plane, which can lead to data breaches or leaks beyond the traditional landscape.

“Collectively, these security issues are a call to action for developing and enhancing cloud security awareness, configuration, and identity management. As cloud business models and security tactics evolve, there is an even greater need to address security issues that are situated higher up the technology stack and are the result of senior management decisions,” said Jon-Michael C. Brook, co-chair, Top Threats Working Group, and one of the paper’s lead authors.

The Pandemic 11 ranked the following concerns in order of significance (with applicable previous rankings) and provides control (Cloud Controls Matrix v4) recommendations and real-world reference examples to assist compliance, risk, and technology staff. Of note is the fact that traditional cloud security issues were found to be less of a concern, with some (e.g., shared technology vulnerabilities, and CSP system vulnerabilities), which featured in the previous Treacherous 12, rated so low that they were excluded in this report:

1. Insufficient identity, credential, access and key management (#4)
2. Insecure interfaces and APIs (#7)
3. Misconfiguration and inadequate change control (#2)
4. Lack of cloud security architecture and strategy (#3)
5. Insecure software development
6. Unsecure third-party resources
7. System vulnerabilities
8. Accidental cloud data disclosure/disclosure
9. Misconfiguration and exploitation of serverless and container workloads
10. Organized crime/hackers/APT
11. Cloud storage data exfiltration

“Considering that user interfaces and APIs are the modern way to consume services, it’s concerning that there are still significant challenges when it comes to securing these features. The cloud – with its complexity – is also the perfect place for attackers to hide and an ideal launchpad for attacks. Add to that the fact that insider threats make it more challenging to protect organizations from data loss and it becomes clear that more industry attention and research is required,” said John Yeoh, Global Vice President of Research, Cloud Security Alliance.

The CSA Top Threats Working Group aims to provide organizations with an up-to-date, expert-informed understanding of cloud security risks, threats and vulnerabilities in order to make educated risk-management decisions regarding cloud adoption strategies. Individuals interested in becoming involved in the future research and initiatives of this group are invited to do so by visiting the Join page.

Download this free document.

Top‌ ‌Threats‌ ‌to‌ ‌Cloud‌ ‌Computing: Pandemic 11, which was sponsored by cybersecurity company ExtraHop, surveyed 703 industry experts on security issues in the cloud industry. CSA research prides itself on vendor neutrality, agility, and integrity of results. Sponsors are CSA Corporate Members who support the findings of the research project but have no added influence on the content development or editing rights to CSA research.

About ExtraHop
Cyberattackers have the advantage. ExtraHop is on a mission to help you take it back with security that can’t be undermined, outsmarted, or compromised. Our dynamic cyber defense platform, Reveal(x) 360, helps organizations detect and respond to advanced threats––before they compromise your business. We apply cloud-scale AI to petabytes of traffic per day, performing line-rate decryption and behavioral analysis across all infrastructure, workloads, and data-in-flight. With complete visibility from ExtraHop, enterprises can detect malicious behavior, hunt advanced threats, and forensically investigate any incident with confidence. ExtraHop has been recognized as a market leader in network detection and response by IDC, Gartner, Forbes, SC Media, and numerous others.

When you don’t have to choose between protecting your business and moving it forward, that’s security uncompromised. Learn more at www.extrahop.com.

About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa.