Nearly four in 10 organisations globally are leaving themselves exposed at the highest levels due to the ‘toxic cloud triad’ of publicly exposed, critically vulnerable and highly privileged cloud workloads.
This is according to Tenable, the exposure management company, which released its 2024 Tenable Cloud Risk Report, which examines the critical risks at play in modern cloud environments.
Each of these misalignments alone introduces risk to cloud data, but the combination of all three drastically elevates the likelihood of exposure access by cyber attackers.
Deep dive
Security gaps caused by misconfigurations, risky entitlements and vulnerabilities combine to dramatically increase cloud risk. The Tenable Cloud Risk Report provides a deep dive into the most pressing cloud security issues observed in the first half of 2024, highlighting areas such as identities and permissions, workloads, storage resources, vulnerabilities, containers and Kubernetes. It also offers mitigation guidance for organisations seeking ways to limit exposures in the cloud.
Publicly exposed and highly privileged cloud data lead to data leaks. Critical vulnerabilities exacerbate the likelihood of incidents. The report reveals that a staggering 38% of organisations have cloud workloads that meet all three of these toxic cloud triad criteria, representing a perfect storm of exposure for cyber attackers to target. When bad actors exploit these exposures, incidents commonly include application disruptions, full system takeovers, and DDoS attacks that are often associated with ransomware. Scenarios like these could devastate an organisation, with the 2024 average cost of a single data breach approaching $5 million.
Additional key findings
●84% of organisations have risky access keys to cloud resources: The majority of organisations (84.2%) possess unused or longstanding access keys with critical or high severity excessive permissions, a significant security gap that poses substantial risk.
●23% of cloud identities have critical or high severity excessive permissions: Analysis of Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure reveals that 23% of cloud identities, both human and non-human, have critical or high severity excessive permissions.
●Critical vulnerabilities persist: Notably, CVE-2024-21626, a severe container escape vulnerability that could lead to the server host compromise, remained unremediated in over 80% of workloads even 40 days after its publishing.
●74% of organisations have publicly exposed storage: 74% of organisations have publicly exposed storage assets, including those in which sensitive data resides. This exposure, often due to unnecessary or excessive permissions, has been linked to increased ransomware attacks.
●78% of organisations have publicly accessible Kubernetes API servers: Of these, 41% also allow inbound internet access. Additionally, 58% of organisations have cluster-admin role bindings — which means that certain users have unrestricted control over all the Kubernetes environments.
Access exposures
“Our report reveals that an overwhelming number of organisations have access exposures in their cloud workloads of which they may not even be aware,” said Shai Morag, chief product officer, Tenable.
“It’s not always about bad actors launching novel attacks. In many instances, misconfigurations and over-privileged access represent the highest risk for cloud data exposures. The good news is, many of these security gaps can be closed easily once they are known and exposed.”
The report reflects findings by the Tenable Cloud Research team based on telemetry from billions of cloud resources across multiple public cloud repositories, analysed from January 1 through June 30, 2024.--TradeArabia News Service
