Cloud computing security report 2019 is out from CSA

The Cloud Security Alliance (CSA) defines standards, certifications, and best practices to help ensure a secure cloud computing environment. The CSA has released "Top Threats to Cloud Computing: The Egregious Eleven", a report which re-examines the risks inherent with cloud security and takes a new approach, examining the problems inherent in configuration and authentication, rather than the traditional focus on vulnerabilities and malware. 

Their report differs from past iterations most noticeably in that many traditional cloud security issues that fall to cloud service providers (CSPs) including denial of service, shared technology, CSP data loss, and system vulnerabilities that featured in the previous Treacherous 12 have dropped off the list. This suggests that traditional security issues are either being well addressed or are no longer perceived as a significant business risk of cloud adoption, while those that are the result of senior management decisions around cloud strategy and implementation are of increasing concern.

Threats to Cloud Computing: Egregious Eleven

The report provides controls recommendations and reference examples meant to be of use to compliance, risk, and technology staff, highlights the following Egregious Eleven (ranked in order of significance):

1. Data Breaches 
2. Misconfiguration and inadequate change control
3. Lack of cloud security architecture and strategy
4. Insufficient identity, credential, access, and key management 
5. Account hijacking 
6. Insider threat 
7. Insecure interfaces and APIs 
8. Weak control plane 
9. Metastructure and applistructure failures
10. Limited cloud usage visibility 
11. Abuse and nefarious use of cloud services

“New, top-ranking items in the survey are more nuanced and suggest a maturation of security professionals’ understanding of the cloud, and the emerging issues that are harder to address as infrastructure becomes more secure and attackers more sophisticated. The new issues highlighted in this version of the report are inherently specific to the cloud and suggest a technology landscape where security professionals are actively considering cloud migration. We hope this Top Threats report raises organizational awareness of the top security issues that require more industry attention and research, ensuring that they are taken into consideration when budgeting for cloud migration and security,” said Jon-Michael C. Brook, co-chair of the Top Threats Working Group and a principal contributor to the industry. 

“The complexity of the cloud can be the perfect place for attackers to hide, offering concealment as a launchpad for further harm. Unawareness of the threats, risks, and vulnerabilities makes it more challenging to protect organizations from data loss. The security issues outlined in this iteration of the Top Threats report, therefore, are a call to action for developing and enhancing cloud security awareness, configuration, and identity management,” said John Yeoh, Global Vice President/Research for CSA.