Identifying & Analysing Emerging Cloud Threats

Uploaded on 2023-08-23 in NEWS-News Analysis, FREE TO VIEW, BUSINESS-Services-IT & Telecoms

A new report from Aqua Security analysed 700,000 attacks in the wild and an analysis of threat actors’ changing tactics, techniques, and procedures. It provides security practitioners with greater insight into the mind of the attacker to help you make better, faster decisions to protect your entire cloud native stack.

Cloud computing has transformed how businesses design, develop, deploy, and manage their applications for improved scalability, flexibility, and agility.

However, the sheer speed and scope of the cloud native environment demands smarter decisions when prioritising limited resources. Moreover, its enlarged attack surface and level of complexity attract additional risk, which must be addressed to meet the original purpose of deciding to migrate to the cloud.

Of the many findings in the report, one of the most significant demonstrates that threat actors are heavily investing resources to avoid detection and establish a stronger foothold in compromised systems. The research found that in one year there has been a 1,400% surge in fileless or memory-based attacks, which exploit existing software, applications, and protocols to perform malicious activities.

The tricky part is that the distributed nature of cloud native applications and associated components make it difficult to identify and mitigate potential threats. That’s why learning from the wider experiences of other companies can help bolster your defences. We have grouped our findings around three distinct areas based on this wider feedback.

Software Supply Chain Threats

The development and distribution of software in a cloud-based environment is characterised by intricate networks of dependencies involving multiple entities. These entities include cloud service providers, source-code management applications, CI/CD tools, and registries, all playing crucial roles at different stages of the SDLC process. Cloud-based software systems are highly interconnected, comprising numerous layers of components that interact with one another. Consequently, ensuring the security of the software supply chain becomes a formidable challenge.

This complexity introduces a vast attack surface, encompassing various applications, which can potentially result in misconfigurations and vulnerabilities. According to our research, instances of software supply-chain attacks have seen a staggering year-over-year growth rate of over 300%. Gartner predicts that by 2025, 45% of organizations would have experienced a software supply chain attack.

We found that malicious intruders can hijack software packages as attack vectors to disrupt the supply chain. At the same time, package planting enables attackers to disguise malicious payloads as legitimate. Additional recent research demonstrated how registries, which are a key part of the software supply chain in the cloud, can act as first access to expand across the cloud.

Risk Posture Assessment

It is crucial to introduce robust and consistent cloud security protocols, such as identifying and patching vulnerabilities while repairing any misconfigurations. That’s because the development of cloud-first software, while transforming how we do business, has also opened us up to new threat actors and new weak spots.

There are many variations when it comes to the potential impact of these new vulnerabilities. Some enable privilege escalation, some expose data, but attackers often look to vulnerabilities that enable remote code execution because these can allow them to gain access to virtually any server and malicious action they want to trigger. Once malicious forces gain initial access, there are many techniques in their toolbox to evade detection, bypass restrictions, and build persistence.

Our research showed that the top ten vulnerabilities scanned in 2022 (excepting Log4Shell which was overwhelmingly high compared to the rest) were mostly related to the ability to conduct remote code execution. This supports the theory that attackers are looking for initial access to run malicious code on remote systems.

The Importance Of Monitoring Runtime

Defending workloads in a runtime environment (where code executes) is vital to securing the integrity of your business data and applications. It is a tantalising opportunity for bad actors to seize data and cause disruption so we mustn’t leave runtime environments exposed to attack vectors.

Begin by introducing a monitoring protocol which includes scanning for known malicious files and network communications, then blocking them and alerting when they surface. Add monitoring for markers that indicate malicious behaviours, such as unauthorised attempts to access sensitive data, efforts to conceal processes while promoting privileges, and opening back doors to unvalidated IP addresses.

At the end of the day, it is crucial to deploy robust, reliable defence mechanisms from code to cloud to ensure that both data and applications are well protected against malicious attacks.

Key Takeaways

Threats are now focusing on avoiding detection to build a stronger presence in compromised systems.

Even minor misconfigurations in the software supply chain can open the door to vulnerabilities across the application’s lifecycle.

More threats are targeting the runtime environment, which continues to be attack surface with most immediate blast impact.

Nurit Bielorai is Product Manager at Aqua Security

You Might Also Read:

Open Source Software In The Cloud:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.