Cloud Security Alliance’s Top Threats to Cloud Computing: Pandemic 11 Report Finds Traditional Cloud Security Issues Becoming Less Concerning

The Cloud Security Alliance (CSA) released Top Threats to Cloud Computing: The Pandemic 11. The report, the sixth in the Top Threats to Cloud Computing series, found a marked change in what cloud security provider (CSP) security issues are seen as concerning. New, more nuanced items, such as configuration and authentication, suggest both that consumers’ understanding of the cloud has matured, and signals a technology landscape where consumers are actively considering cloud migration.

Respondents indicated topics such as control plane weaknesses, metastructure (i.e., mechanisms that provide the interface between the infrastructure and other layers) and applistructure (applications deployed in the cloud and the services used to build them) failures, and limited cloud visibility as top concerns – a marked departure from more generic threats, risks, and vulnerabilities (i.e. data loss, denial of service) that featured more strongly in previous Top Threats reports. Other top threats in this year’s survey highlight lack-of-control type hurdles that users may experience with CSPs, such as limited cloud usage visibility and a weak control plane, which can lead to data breaches or leaks beyond the traditional landscape.

“Collectively, these security issues are a call to action for developing and enhancing cloud security awareness, configuration, and identity management. As cloud business models and security tactics evolve, there is an even greater need to address security issues that are situated higher up the technology stack and are the result of senior management decisions,” said Jon-Michael C. Brook, co-chair, Top Threats Working Group, and one of the paper’s lead authors.

The Pandemic 11 ranked the following concerns in order of significance (with applicable previous rankings) and provides control (Cloud Controls Matrix v4) recommendations and real-world reference examples to assist compliance, risk, and technology staff. Of note is the fact that traditional cloud security issues were found to be less of a concern, with some (e.g., shared technology vulnerabilities, and CSP system vulnerabilities), which featured in the previous Treacherous 12, rated so low that they were excluded in this report:

1. Insufficient identity, credential, access and key management (#4)
2. Insecure interfaces and APIs (#7)
3. Misconfiguration and inadequate change control (#2)
4. Lack of cloud security architecture and strategy (#3)
5. Insecure software development
6. Unsecure third-party resources
7. System vulnerabilities
8. Accidental cloud data disclosure/disclosure
9. Misconfiguration and exploitation of serverless and container workloads
10. Organized crime/hackers/APT
11. Cloud storage data exfiltration

“Considering that user interfaces and APIs are the modern way to consume services, it’s concerning that there are still significant challenges when it comes to securing these features. The cloud – with its complexity – is also the perfect place for attackers to hide and an ideal launchpad for attacks. Add to that the fact that insider threats make it more challenging to protect organizations from data loss and it becomes clear that more industry attention and research is required,” said John Yeoh, Global Vice President of Research, Cloud Security Alliance.

Download this free document.