The number of cloud migrations is growing every year, and the security issues remain a serious topic. The first step to minimize the risks in the cloud is the timely identification of key security concerns. These issues also disturb the bookkeeping of the company. At a conference, CSA (Cloud Security Alliance) presented a list of 10 threats to cloud security that organizations face, which are as follows.

1. Data leakage

The cloud is subject to the same concerns as traditional infrastructures. Because of a large amount of data that is now often transferred to the clouds, the cloud hosting provider sites become an attractive target for intruders. Simultaneously, the severity of potential threats directly depends on the importance of the stored data. Disclosure of personal user information, as a rule, receives less publicity than disclosure of medical reports, commercial secrets, intellectual property, which causes significant damage to the reputation of a company.

2. Compromising Accounts and Bypassing Authentication

Data leakage is often the result of a negligent attitude to authentication mechanisms when weak passwords are used. The management of encryption keys and certificates is inadequate. Also, organizations face the problems of managing rights and permissions, when end users are assigned much higher power than needed. The issue also occurs when the user is transferred to another position or gets fired. As a result, the account contains many more features than required, which is a bottleneck in the issue of security.

3. Hacking interfaces and API

Today, cloud-based services and applications are inconceivable without a user-friendly interface. The security and availability of cloud services depend on how well the mechanisms of access control, encryption in the API are developed. When interacting with a third party using their APIs, the risks increase because companies need to provide additional information, up to the user’s login and password. Weak security interfaces are becoming a bottleneck in issues of accessibility, confidentiality, integrity, and security.

4. The vulnerability of the systems used

The vulnerability of the systems used is a problem that occurs in multi-tenant cloud environments. According to CSA reports, the costs spent on reducing system vulnerabilities are lower than other IT costs. A common mistake when using cloud solutions in the IaaS model, companies pay insufficient attention to the security of their applications, which are located in the security infrastructure of the cloud provider.

5. Account theft

Phishing and other fraud are often present in the cloud environment. This fraud adds concerns in the form of attempts to manipulate transactions and modify data. Attackers consider cloud platforms as a field for committing attacks. And even compliance with the strategy of “protection in depth” may not be sufficient. It is necessary to prohibit the “sharing” of user accounts and services among themselves and pay attention to the mechanisms of multifactor authentication.

6. Insiders-intruders

Insider threats can come from current or former employees, system administrators, contractors, or business partners. Insiders-attackers pursue different goals, ranging from data theft to the desire to revenge. In the case of a cloud, the goal may be to wholly or partially destroy the infrastructure, gain access to data, and so on.

7. Target cyberattacks

A developed sustainable threat, or targeted cyber attack, is, at this time, not uncommon. Having sufficient knowledge and a set of relevant tools, an individual can achieve results. The malefactor, who set out to establish and consolidate his presence in the target infrastructure, is not easy to detect.

8. Permanent data loss

Since the clouds have matured enough, cases with loss of data without the possibility of recovery due to the service provider are sporadic. At the same time, intruders, knowing about the consequences of permanent data deletion, aim to commit such destructive actions. Cloud hosting providers to comply with security measures recommend separating user data from these applications, saving them in different locations.

9. Insufficient awareness

Organizations that move into the cloud without understanding cloud capabilities face risks. If, for example, the client-side development team is not familiar with the cloud technology features and the principles of deploying cloud applications, operational and architectural problems arise.

10. Abuse of cloud services

Legitimate and illegitimate organizations can use clouds. The latter’s goal is to use cloud resources to commit malicious acts: launching DDoS attacks, sending spam, distributing malicious content, etc. Service providers need to be able to recognize such participants. Study traffic in detail and use cloud monitoring tools.

Sumber: https://www.completecontroller.com/