Identifying & Analysing Emerging Cloud Threats

A new report from Aqua Security analysed 700,000 attacks in the wild and an analysis of threat actors’ changing tactics, techniques, and procedures. It provides security practitioners with greater insight into the mind of the attacker to help you make better, faster decisions to protect your entire cloud native stack
  
Cloud computing has transformed how businesses design, develop, deploy, and manage their applications for improved scalability, flexibility, and agility.

However, the sheer speed and scope of the cloud native environment demands smarter decisions when prioritising limited resources. Moreover, its enlarged attack surface and level of complexity attract additional risk, which must be addressed to meet the original purpose of deciding to migrate to the cloud.

Of the many findings in the report, one of the most significant demonstrates that threat actors are heavily investing resources to avoid detection and establish a stronger foothold in compromised systems. The research found that in one year there has been a 1,400% surge in fileless or memory-based attacks, which exploit existing software, applications, and protocols to perform malicious activities.

The tricky part is that the distributed nature of cloud native applications and associated components make it difficult to identify and mitigate potential threats. That’s why learning from the wider experiences of other companies can help bolster your defences. We have grouped our findings around three distinct areas based on this wider feedback.

Software Supply Chain Threats

The development and distribution of software in a cloud-based environment is characterised by intricate networks of dependencies involving multiple entities. These entities include cloud service providers, source-code management applications, CI/CD tools, and registries, all playing crucial roles at different stages of the SDLC process. Cloud-based software systems are highly interconnected, comprising numerous layers of components that interact with one another. Consequently, ensuring the security of the software supply chain becomes a formidable challenge.

This complexity introduces a vast attack surface, encompassing various applications, which can potentially result in misconfigurations and vulnerabilities. According to our research, instances of software supply-chain attacks have seen a staggering year-over-year growth rate of over 300%. Gartner predicts that by 2025, 45% of organizations would have experienced a software supply chain attack.

We found that malicious intruders can hijack software packages as attack vectors to disrupt the supply chain. At the same time, package planting enables attackers to disguise malicious payloads as legitimate. Additional recent research demonstrated how registries, which are a key part of the software supply chain in the cloud, can act as first access to expand across the cloud.

Risk Posture Assessment

It is crucial to introduce robust and consistent cloud security protocols, such as identifying and patching vulnerabilities while repairing any misconfigurations. That’s because the development of cloud-first software, while transforming how we do business, has also opened us up to new threat actors and new weak spots.

There are many variations when it comes to the potential impact of these new vulnerabilities. Some enable privilege escalation, some expose data, but attackers often look to vulnerabilities that enable remote code execution because these can allow them to gain access to virtually any server and malicious action they want to trigger. Once malicious forces gain initial access, there are many techniques in their toolbox to evade detection, bypass restrictions, and build persistence.

Our research showed that the top ten vulnerabilities scanned in 2022 (excepting Log4Shell which was overwhelmingly high compared to the rest) were mostly related to the ability to conduct remote code execution. This supports the theory that attackers are looking for initial access to run malicious code on remote systems.

The Importance Of Monitoring Runtime

Defending workloads in a runtime environment (where code executes) is vital to securing the integrity of your business data and applications. It is a tantalising opportunity for bad actors to seize data and cause disruption so we mustn’t leave runtime environments exposed to attack vectors.

Begin by introducing a monitoring protocol which includes scanning for known malicious files and network communications, then blocking them and alerting when they surface. Add monitoring for markers that indicate malicious behaviours, such as unauthorised attempts to access sensitive data, efforts to conceal processes while promoting privileges, and opening back doors to unvalidated IP addresses.

At the end of the day, it is crucial to deploy robust, reliable defence mechanisms from code to cloud to ensure that both data and applications are well protected against malicious attacks.

Key Takeaways

  • Threats are now focusing on avoiding detection to build a stronger presence in compromised systems.
  • Even minor misconfigurations in the software supply chain can open the door to vulnerabilities across the application’s lifecycle.
  •  More threats are targeting the runtime environment, which continues to be attack surface with most immediate blast impact.

Nurit Bielorai is Product Manager at Aqua Security

You Might Also Read: 

Open Source Software In The Cloud:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Major Sporting Events Are Open Targets
AI Is The Next Big Thing For Browser Security   »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Council of European Professional Informatics Societies (CEPIS)

Council of European Professional Informatics Societies (CEPIS)

CEPIS is the representative body of national informatics associations throughout Europe and represent over 450,000 ICT and informatics professionals in 32 countries.

Academic Centres of Excellence in Cyber Security Research

Academic Centres of Excellence in Cyber Security Research

The ACE-CSRs scheme is part of the UK Government’s National Cyber Security Strategy, working with academia and industry to make the UK more resilient to cyber attacks.

Awake Security

Awake Security

Awake Security offer a security solution built on an AI platform that acts like the human brain to sense, detect, and respond to threats you may not even know exist.

Aricoma

Aricoma

Aricoma are Architects of Digital. We aim to become a major player in end-to-end IT services and digital transformation in Europe.

Eperi

Eperi

Eperi is a leading provider of Cloud Data Protection (CDP) solutions with 15 years of experience in data encryption for databases, (SaaS) applications and files.

PeopleSec

PeopleSec

PeopleSec specializes in the human element of cybersecurity with a comprehensive set of services designed to maximize your security by educating your workforce as a whole.

Calyptix Security

Calyptix Security

Calyptix Security helps small and medium offices secure their networks so they can raise profits, protect investments, and control technology.

Nu Quantum

Nu Quantum

Nu Quantum is developing quantum photonics hardware to power the quantum revolution in communications, sensing and computing.

DAtAnchor

DAtAnchor

Anchor is simply a better way to protect and control sensitive data. Zero-trust, data-centric security. Simplified.

BluescreenIT (BIT)

BluescreenIT (BIT)

BluescreenIT is an IT Security Consultancy and IT and Cyber Security Training company supporting industry, local authorities, MoD and governmental IT departments.

Imageware

Imageware

Imageware is a leader in biometric cybersecurity. Protect against costly, damaging ransomware hacks by employing biometric cybersecurity solutions.

Cyber7

Cyber7

CYBER7 is a National Cyber Security Innovation community initiated by Israel National Cyber Directorate, Ministry of Economy and Israel Innovation Authority led by Tech7 – Venture Studio.

Green Enterprise Solutions

Green Enterprise Solutions

Green Enterprise Solutions are a Namibian company providing Information and Communication Technology (ICT) services to corporate Namibia.

Siometrix

Siometrix

Siometrix addresses digital identity fraud. It steals your attacker's time and prevents many prevalent attack vectors.

Lintu Solutions

Lintu Solutions

Lintu Solutions is a trusted provider of comprehensive cybersecurity and enterprise risk management solutions.

Index Engines

Index Engines

Index Engines is the world’s leading AI-powered analytics engine to detect data corruption due to ransomware.