Managing the top security threats to public cloud

SaaS – Software as a service

Context
The 2022 Verizon Data Breach Investigation Report indicated that web applications are one of the top vectors for attacks. While it is the SaaS provider’s responsibility to remediate the vulnerabilities and update the applications, the SaaS customer is responsible for implementing best practices to secure the application configuration.

Main threats
Even though SaaS applications seem like the easiest model to choose and the least burdensome for customers, threats against SaaS applications cannot be easily eliminated. Because SaaS puts applications, data, user identities and endpoints into play, they face threats like application vulnerabilities, misconfigurations, insecure permissions and data loss.

In fact, 47% of organizations are concerned about sensitive data loss or exfiltration from cloud and web attacks, according to the 2022 CSA Cloud and Web Security Challenges report. The challenge comes in two forms:

• Shadow IT¹ services are a governance and compliance nightmare for CISOs and IT administrators. Companies risk losing control over their data if employees upload sensitive data onto a shared public drive that has not been approved, or onto their personal cloud storage service. Without visibility, there’s no way to control the leaks.
• Even when SaaS applications like Office 365 are approved by the IT department, misconfigurations that lead to data breaches are likely to happen. Cloud misconfigurations often result from enabling excessive permissions. By granting users too many rights, you increase the attack surface that can be exploited by hackers and malicious insiders by taking advantage of wide-ranging permissions.

Countermeasures
User identity protection can be enhanced by enforcing multifactor authentication (MFA) and role-based access control. Bring your own device (BYOD) and hybrid work model have increased the emphasis on endpoint and mobile device management because they can allow malicious data upload and data leak into the SaaS applications. Hence, data encryption at rest or transit and endpoint/threat protections (EDR, MDR, XDR) are also important to counter malware attacks on the cloud.

^{[1] IT systems that are not supported by the IT department but are implemented without their knowledge.}

PaaS – Platform as a Service

Context
PaaS enables developers and organizations to build, run and manage applications without the need to manage underlying expensive infrastructure.

Main threats
Risks related to applications are one of the main focuses of PaaS. Zero-day vulnerabilities in applications and supporting libraries are a very serious issue to be considered. One of the biggest zero-day vulnerability of the decade is the Log4shell vulnerability.

Finding a zero-day vulnerability can take a lot of time, especially identifying which areas were impacted. Moreover, patching can also be a complex and time-consuming process, which is why organizations must be able to implement a more proactive approach.

Countermeasures
Static application security testing (SAST) and dynamic application security testing (DAST) can be used to identify such exploits. Adopting DevSecOps security practices early in the CI/CD pipeline ensures continuous testing and verification of the code during the initial stage of development. Zero-day application vulnerabilities can be thwarted by properly configuring rules on web application firewalls. Monitoring application and security logs for any unauthorized API calls is mandatory.

IaaS – Infrastructure as a Service

Context
IaaS could be easier to migrate from on-premises, but the cost burden, administration overhead and most importantly, the security landscape, remain the same. Managing the compute, storage, network, platform, identity, endpoint, applications and data creates a plethora of responsibilities for an organization.

Last Pass
one of the world’s leading password managers — recently reported a security incident on its development environment. An attacker compromised a developer’s identity, gained access to the source code and some proprietary information, but no customer data was lost. This incident is an excellent example of how a vast attack surface can become a playground for an attacker.

Main threats
The major threat to IaaS (in addition to those mentioned for SaaS and PaaS) are its controls and standards. Unlike traditional IT, IaaS mainly relies on code and APIs that can be compromised or exposed. Poor coding can immediately put API security at risk. Code injections, in which an attacker sends a script to an application server through an API request, are another threat to APIs that lack the right authentication and validation processes. Such an attack can result in data exfiltration and harm the application.

Countermeasures
While infrastructure as code (IaC) can solve issues related to inconsistent configurations, scalability and availability, configuration templates and images should be stored in a trusted registry, and vulnerability assessments should be conducted often. Secrets must be managed via key management.