The stormy cybersecurity horizon will leave its mark on cloud-based assets next year. However, despite the looming threats, experts see no stopping on migration to the cloud.
2021 was a pivotal year in cybersecurity, with ransomware dominating the headlines. With the upward trend in cybercrime unlikely to change next year, the need to secure cloud-based assets will only increase.
From our partners:
As much as 79% of companies have experienced cloud data breaches in the last 18 months, with 43% suffering from ten cloud-based intrusion attempts.
Since studies show over 90% of organizations keep at least some of their digital assets in the cloud, the need for protection will have to become a top priority.
I asked experts to share their insights about what to expect in cloud security next year, and here’s what they said.
“Enterprises realize that they need to incorporate additional cloud security measures, on top of what cloud providers offer.”
-James Campbell, CEO and Co-Founder at Cado Security.
Protecting critical infrastructure
The security landscape is getting ever more complex with governments copying businesses in cloud adoption, Leon Kuperman, CTO and Co-Founder at CAST AI, claims.
Major cloud service providers (CSPs) such as AWS, Azure, GCP, Oracle, and IBM race to lure governments to use their version of secure data centers. Microsoft, for example, talks about ‘top secret’ cloud with others offering their own ‘air gap’ offers to the mix.
“The movement of workloads from private underground facilities to cloud provider-operated data centers has the potential to introduce significant efficiencies but also introduces a security risk. This is a vulnerable transition point that attackers will exploit,” Kuperman told CyberNews.
Buffing up internal security
According to James Campbell, CEO and Co-Founder at Cado Security, 2021 has proven that relying on security tools provided by CSPs is no longer enough.
First, researchers discovered a major issue with Azure that could have allowed threat actors to get complete control of other users’ data. Later the OMIGOD vulnerability, enabling attackers to escalate to root privileges and remotely execute malicious code, came to light.
“Enterprises realize that they need to incorporate additional cloud security measures, on top of what cloud providers offer, as they don’t fully manage the security risks that come with leveraging the cloud,” Campbell wrote in an email.
He thinks that organizations should consider a layered approach to cloud security, knowing what accesses third-party vendors have and don’t have. Businesses need to take responsibility for their security to prevent malicious activity instead of blindly trusting the CSPs.
READ MORE: [button style=’accent’ url=’https://aster.cloud/2021/10/06/to-avoid-cyberattacks-companies-need-to-think-like-hackers/’ target=’_blank’ arrow=’true’ fullwidth=’true’]TO AVOID CYBERATTACKS, COMPANIES NEED TO THINK LIKE HACKERS[/button]
[button style=’accent’ url=’https://aster.cloud/2021/12/21/securing-the-cloud-cyber-risks-and-best-practices-you-need-to-keep-in-mind/’ target=’_blank’ arrow=’true’ fullwidth=’true’]SECURING THE CLOUD: CYBER RISKS AND BEST PRACTICES YOU NEED TO KEEP IN MIND[/button]
On-premise attacks
The pandemic forced many companies to abruptly migrate to the cloud to continue operating. Rapid ascension to the cloud has caused many to cut corners on security, causing COVID ‘hangover’ in the industry.
According to Menachem Shafran, a cybersecurity expert and VP Product at XM Cyber, headaches will continue to trouble many in 2022, as rushed migration left many issues with security.
Security gaps will lead to more attacks that start on-premise and pivot to the cloud to compromise critical assets or vice versa.
“Cyber attackers are increasingly leveraging misconfigurations, overly permissive identities, vulnerabilities, and general human errors to obtain an initial foothold and move laterally through the enterprise network until they are able to breach the cloud environment. This will lead to serious financial and reputational costs in 2022,” Shafran told CyberNews.
“As organizations move to multiple cloud providers, we predict the multi-cloud misconfiguration will become the next source of cloud vulnerabilities and attack surface.”
-Leon Kuperman, CTO and Co-Founder at CAST AI.
Multi-cloud approach
According to Shafran, we will see more companies cherry-picking the best features from multiple vendors next year, driving the need for multi-cloud environment monitoring.
Meanwhile, Kuperman suggests that the multi-cloud approach offers some new security challenges. People responsible for securing such an environment will have to understand the intricacies of several cloud platforms, making the task exponentially complex with every new vendor introduced.
“As organizations move to multiple cloud providers, we predict the multi-cloud misconfiguration will become the next source of cloud vulnerabilities and attack surface,” Kuperman explained.
Keith Neilson, Technical Evangelist at CloudSphere, suggests that even though the pace of migration to the cloud is unlikely to decelerate, keeping the data on-premise remains a feasible option to some companies.
“This is especially true for highly sensitive or highly-regulated data sets or situations where keeping the apps and data on-prem better supports integration, performance, reliability, and security,” Neilson wrote.
Need to educate
A staggering 74% of enterprises have experienced security and compliance issues due to insufficient collaboration between local and cloud teams. According to Bob Huber, the Chief Security Officer at Tenable, companies will need to invest in education to avoid miscommunication.
“Detecting and preventing malicious activity in the cloud is a lot different from mitigating it on-prem. And this can be further complicated by the nuances of working with cloud providers, as well as other company stakeholders looking to rapidly adopt new services in the cloud,” Huber told CyberNews.
Ilia Sotnikov, Security Strategist & VP of User Experience at Netwrix, thinks the problem is exacerbated by the multi-cloud approach, as there is a lack of experts able to navigate between different platforms easily.
“Cloud platforms are constantly evolving, meaning the knowledge and experience quickly become outdated unless you constantly sharpen your skills,” Sotnikov explained.
“Cloud platforms are constantly evolving, meaning the knowledge and experience quickly become outdated unless you constantly sharpen your skills.”
-Ilia Sotnikov, Security Strategist & VP of User Experience at Netwrix.
Lack of talent
Many businesses might face issues with finding capable teachers and willing students as well. According to Kuperman, the industry lacks 2.7 million cybersecurity professionals globally, and the lack of talent in 2022 will be even more acute.
“We simply do not have the people to keep up with the rising threat, and automation needs to be heavily deployed in an effort to keep up. This is compounded by the stark reality that attackers only have to be right one time to pull off a successful cyber attack,” Kuperman wrote.
With the wave of cybercrime unlikely to recede, the lack of capable cloud security experts will only add to the pile of security problems companies face, claims Dave MacKinnon, Chief Security Officer at N-able,
“A big shift to the cloud, a lack of cloud security expertise across many MSP organizations, plus the continued growth of an increasingly hostile security landscape, is creating a potentially dangerous mixture,” MacKinnon said.
For enquiries, product placements, sponsorships, and collaborations, connect with us at [email protected]. We'd love to hear from you!
Our humans need coffee too! Your support is highly appreciated, thank you!
