New Frontier of Cloud Hacking
Clouds are constantly changing, rapidly iterating technologies striving to offer new and valuable data products. Companies are wise to avail themselves of such a powerful tool.
An Enormous Attack Surface
Moving to the cloud has many advantages but cybersecurity is not among them. The risk is the same if not elevated. Clouds get hacked just like traditional on-premises networks. Most companies are unaware that Cybersecurity in the Cloud is a shared security model.
- Cloud providers are responsible for “Security of the Cloud”
- Customers are responsible for “Security in the Cloud”
Companies are responsible for securing their data and applications within the cloud. From the standpoint of cybersecurity very little has changed. Going forward Cloud hacking will be a new rich frontier for malicious actors.
One of the main issues with clouds is enumerating and understanding the attack surface that each cloud tenant offers to the Internet. Cloud environments are highly complex and dynamic, with constantly changing infrastructure and configurations. Clouds can expand or contract at will, often without proper understanding and representation within a company’s topology.
Cloud environments require a high degree of automation to keep up with the scale and complexity of the infrastructure. However, this can also introduce new security risks if not implemented properly.
Cloud administrators can easily add resources without considering the cybersecurity implications of their actions. Developers can provision then tear down resources leaving residual data that can be exploited. Cloud storage while capable, is susceptible to misconfiguration that can disclose sensitive data to the Internet.
Vulnerabilities Particular To Clouds
There are vulnerabilities that are particular to clouds based on their design:
- Cloud platforms often have metadata endpoints that provide information about running instances or other cloud services. An Server-side Request Forgery (SSRF) vulnerability can be exploited by attackers to send requests to these metadata endpoints from a vulnerable application running in the cloud, allowing them to exfiltrate sensitive information about the cloud environment or even gain access to other cloud services.
- Insecure APIs allow an attacker the ability to perform unapproved actions and launch attacks.
- Container Vulnerabilities allow an attacker to escape and gain access to the underlying host operating system.
- Identity and Access Management Misconfigurations can allow a malicious user too much access or the ability to elevate their privileges.
Properly Securing the Cloud
Every company with a sizable cloud footprint should perform a yearly technical and procedural cybersecurity assessment. With a commitment to maintain a strong security posture the threats to cloud security can be met decisively.
