Misconfigurations Found in Cloud Environments of 98.6% of Companies
According to a recent report from Zscaler Threatlabz, despite the convenience and flexibility offered by public cloud technology, many organizations are still grappling with the risks associated with cloud usage as they experience related attacks. The Cloud (In)Security research analyzed cloud workload statistics from over 260 billion daily transactions globally across the Zscaler platform and found that 98.6% of organizations have misconfigurations that pose critical risks to their data and infrastructure.
This is concerning because the majority of cyberattacks on public clouds are due to misconfigurations rather than vulnerabilities. Misconfigurations related to public access to storage buckets, account permissions, password storage, and management have exposed billions of records. Compromised accounts make up for 97.1% of organizations that use privileged user access controls without Multi-Factor Authentication (MFA) enforcement. Gaining privileged account access to the cloud can enable hackers to bypass detection and launch a range of attacks.
Moreover, 59.4% of organizations do not apply basic ransomware controls for cloud storage like MFA Delete and versioning. To secure their cloud environment, organizations must take responsibility for configuring and maintaining it. Although cloud environments are covered under a shared responsibility for security with the service provider, organizations must ensure proper configuration of their cloud environment.
One way to address this issue is through a cloud security posture management (CSPM) service. This service can help identify misconfigurations and, when coupled with cloud infrastructure entitlement management (CIEM), can be used to identify permission issues. This is a logical progression from long-established identity and access management (IAM) and privilege access management (PAM) solutions built on the least-privileged approach.
