New research released by VMware on Monday found that 6 in 10 respondents say implementing cloud security tools has become their top priority.
The study was part of a broader study developed for the first day of Black Hat in Las Vegas that found attackers are launching more targeted, destructive/integrity attacks more than 50% of the time.
On the cloud front, nearly half (43%) of respondents say more than one-third of attacks were targeted at cloud workloads, with almost a quarter (22%) saying that more than half were focused on cloud workloads. The report also found that attackers are using the cloud to island hop along the victim’s supply chain.
“If 2020 was the year of island hopping, where cybercriminals infiltrate large company networks by targeting third- parties with lower levels of protection, then we should expect cloud-jacking through public clouds to go mainstream in 2021, particularly with the mass migrations to public clouds to support distributed workforces,” said Tom Kellermann, VMware’s head of cybersecurity strategy.
The VMware report does not come as a surprise at all, said Vishal Jain, co-founder and CTO at Valtix, who added that the pandemic has accelerated the rush to cloud and cyberattackers will go where they can make the most money quickly. Jain said enterprises had thought through their datacenter security quite well in the past, but now, all of these enterprises are going to the cloud — and the cloud environments are much different than the datacenter.
“Enterprises are still grasping the shared security model in the cloud and have underinvested in cloud-first security to date, which has led to a substantial portion of attacks being focused on cloud infrastructure and workloads,” Jain said. “More and more cloud-focused organizations are discovering that the cloud is different and they cannot secure it effectively by bringing their datacenter security solutions to the cloud. They need cloud-native security models they can easily deploy and adapt to new applications and changes.”
With the ease of use offered by many cloud IaaS and SaaS platforms comes the reality that those spinning up these new cloud environments are less experienced in securing them, said Dirk Schrader, global vice president, security research at New Net Technologies, now part of Netwrix.
“This has become the core aspect that makes securing these deployments so vital for the resilience of organizations using hybrid environments, including public clouds,” Schrader said. “They should use technical controls to ensure that hardened configurations are in place for each instance and that the cloud orchestration itself is aligned and kept in compliance with automated audit capabilities.”