Cloud changes are to blame for nearly all cyber-attacks

Cloud offerings change a lot, and that’s a problem

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

Of all the vulnerabilities an organization’s system has, the majority sit within its cloud environment, a new report from cybersecurity researchers Unit 42, part of Palo Alto Networks, has found.

As per the report, four in five (80%) of all flaws reside in thecloud. Of those flaws, the most common ones are web framework takeover (22%), remote access services (20%), and IT security and networking infrastructure (17%).

The researchers also noted that it’s the newest solutions that are most often the most vulnerable. Almost half (45%) of all high-risk, cloud-hosted exposures in any given month were not there a month before. To make matters worse, cloud providers are quite volatile - Unit 42 estimates that some 20% of all accessible cloud services change at least once a month. Two industries that have it worst are transport & logistics, and insurance & finance, with 27% and 24% of cloud offerings changing every month, respectively.

How to address risk

The best way to mitigate these issues, the researchers say, is to set up an attack surface management program which would be tasked with discovering, prioritizing, and fixing any vulnerabilities.

Unit 42’s mitigation plan would include constant tracking of visibility, continuous review of cloud configurations, better communication and collaboration between security and DevOps, and a solid plan when it comes to prioritizing certain vulnerabilities.

For the past decade, digital transformation and cloud migration have been hailed as the next step in the evolution of business, with organizations of all shapes and sizes moving into the cloud in swathes. Cloud adoption delivered a raft of benefits for organizations, especially during the Covid-19 pandemic when companies needed the flexibility and agility of public, private, and hybrid clouds to support their operations.

But compared to traditional on-premise infrastructure, securing the cloud is an entirely different beast, and organizations that take the idea lightly are risking their entire operations.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

This new phishing strategy utilizes GitHub comments to distribute malware

Should your VPN always be on?

NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)