Identifying & Analysing Emerging Cloud Threats

A new report from Aqua Security analysed 700,000 attacks in the wild and an analysis of threat actors’ changing tactics, techniques, and procedures. It provides security practitioners with greater insight into the mind of the attacker to help you make better, faster decisions to protect your entire cloud native stack
  
Cloud computing has transformed how businesses design, develop, deploy, and manage their applications for improved scalability, flexibility, and agility.

However, the sheer speed and scope of the cloud native environment demands smarter decisions when prioritising limited resources. Moreover, its enlarged attack surface and level of complexity attract additional risk, which must be addressed to meet the original purpose of deciding to migrate to the cloud.

Of the many findings in the report, one of the most significant demonstrates that threat actors are heavily investing resources to avoid detection and establish a stronger foothold in compromised systems. The research found that in one year there has been a 1,400% surge in fileless or memory-based attacks, which exploit existing software, applications, and protocols to perform malicious activities.

The tricky part is that the distributed nature of cloud native applications and associated components make it difficult to identify and mitigate potential threats. That’s why learning from the wider experiences of other companies can help bolster your defences. We have grouped our findings around three distinct areas based on this wider feedback.

Software Supply Chain Threats

The development and distribution of software in a cloud-based environment is characterised by intricate networks of dependencies involving multiple entities. These entities include cloud service providers, source-code management applications, CI/CD tools, and registries, all playing crucial roles at different stages of the SDLC process. Cloud-based software systems are highly interconnected, comprising numerous layers of components that interact with one another. Consequently, ensuring the security of the software supply chain becomes a formidable challenge.

This complexity introduces a vast attack surface, encompassing various applications, which can potentially result in misconfigurations and vulnerabilities. According to our research, instances of software supply-chain attacks have seen a staggering year-over-year growth rate of over 300%. Gartner predicts that by 2025, 45% of organizations would have experienced a software supply chain attack.

We found that malicious intruders can hijack software packages as attack vectors to disrupt the supply chain. At the same time, package planting enables attackers to disguise malicious payloads as legitimate. Additional recent research demonstrated how registries, which are a key part of the software supply chain in the cloud, can act as first access to expand across the cloud.

Risk Posture Assessment

It is crucial to introduce robust and consistent cloud security protocols, such as identifying and patching vulnerabilities while repairing any misconfigurations. That’s because the development of cloud-first software, while transforming how we do business, has also opened us up to new threat actors and new weak spots.

There are many variations when it comes to the potential impact of these new vulnerabilities. Some enable privilege escalation, some expose data, but attackers often look to vulnerabilities that enable remote code execution because these can allow them to gain access to virtually any server and malicious action they want to trigger. Once malicious forces gain initial access, there are many techniques in their toolbox to evade detection, bypass restrictions, and build persistence.

Our research showed that the top ten vulnerabilities scanned in 2022 (excepting Log4Shell which was overwhelmingly high compared to the rest) were mostly related to the ability to conduct remote code execution. This supports the theory that attackers are looking for initial access to run malicious code on remote systems.

The Importance Of Monitoring Runtime

Defending workloads in a runtime environment (where code executes) is vital to securing the integrity of your business data and applications. It is a tantalising opportunity for bad actors to seize data and cause disruption so we mustn’t leave runtime environments exposed to attack vectors.

Begin by introducing a monitoring protocol which includes scanning for known malicious files and network communications, then blocking them and alerting when they surface. Add monitoring for markers that indicate malicious behaviours, such as unauthorised attempts to access sensitive data, efforts to conceal processes while promoting privileges, and opening back doors to unvalidated IP addresses.

At the end of the day, it is crucial to deploy robust, reliable defence mechanisms from code to cloud to ensure that both data and applications are well protected against malicious attacks.

Key Takeaways

  • Threats are now focusing on avoiding detection to build a stronger presence in compromised systems.
  • Even minor misconfigurations in the software supply chain can open the door to vulnerabilities across the application’s lifecycle.
  •  More threats are targeting the runtime environment, which continues to be attack surface with most immediate blast impact.

Nurit Bielorai is Product Manager at Aqua Security

You Might Also Read: 

Open Source Software In The Cloud:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Major Sporting Events Are Open Targets
AI Is The Next Big Thing For Browser Security   »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CQS (Certified Quality Systems)

CQS (Certified Quality Systems)

CQS is an organisation specialising in ISO assessment and certification, including ISO 27001, along with other management system standards.

Bufferzone Security

Bufferzone Security

Bufferzone is a patented containment solution that defends endpoints against advanced malware and zero-day attacks while maximizing user and IT productivity.

Signifyd

Signifyd

Signifyd is the world's largest provider of Guaranteed e-Commerce Fraud Protection.

Saudi Federation for Cyber Security and Programming (SAFCSP)

Saudi Federation for Cyber Security and Programming (SAFCSP)

SAFCSP is a national institution under the umbrella of the Saudi Arabian Olympic Committee, which seeks to build national and professional capabilities in the fields of cyber security and programming.

CyberProof

CyberProof

CyberProof aims to give clarity and confidence to businesses worldwide using a new risk-based approach to cyber security services.

Blockchain Firm

Blockchain Firm

Blockchain Firm is a leading Blockchain based software solutions and service provider with our roots of expertise running deep into the technology.

Partnership for Conflict, Crime and Security Research (PaCCS)

Partnership for Conflict, Crime and Security Research (PaCCS)

PaCCS delivers high quality and cutting edge research to improve our understanding of current and future global security challenges in areas including cybersecurity.

Casque SNR

Casque SNR

CASQUE SNR is the next generation of Identity Assurance that has potential to supersede existing solutions. It provides Identity Assurance for both people and things.

Gluu

Gluu

Modern Authentication for Digital Enterprise. Organizations around the world trust Gluu for large-scale, high-security identity & access management.

Ethyca

Ethyca

Ethyca builds automated data privacy infrastructure and tools for developers and privacy teams to easily build products that comply with GDPR, CCPA Privacy Regulations.

AwareGO

AwareGO

AwareGO is a global provider of security awareness training content and solutions that help enterprises improve cybersecurity awareness in the workplace.

Oman Data Park

Oman Data Park

The Data Park is Oman’s premier IT Managed Services provider. We offer a superior Tier 3 Data Center network providing cyber security and cloud services.

ITC Federal

ITC Federal

ITC Federal delivers IT cybersecurity assessment services to support agencies in meeting their security strategies and federal security compliance goals.

TriVigil

TriVigil

TriVigil offer a full-service, comprehensive cybersecurity approach specifically tailored to meet the unique needs of educational institutions.

Synersoft BLACKbox

Synersoft BLACKbox

Synersoft, the maker of path-breaking and disruptive technology for SMEs, now branded as BLACKbox, is an incubated and invested portfolio company of CIIE - IIM-Ahmedabad.

Nova Microsystems

Nova Microsystems

Nova's mission is to revolutionize cybersecurity through continuous data analysis and dynamic AI-driven encryption.