Compromise of Cloud Environment

If multi-factor authentication (MFA) is not enabled, cloud resources that are accessible via the internet  are vulnerable to the use of stolen credentials, brute force attacks, and common password attacks.. Cybercriminals can also use phishing attacks aimed at IT administrators to gain access to the keys to cloud resources. if a user with an active session is compromised,  the criminal can access the resource as if they were that user.

Moving to the cloud does not mean moving away from security duties: responsibility for security of cloud resources is shared between the customer and the provider. Using default settings, or not paying attention to configuration, can result in data storage or other resources being accessible to unauthorised users. Failure to enable logging and monitoring can make it harder to detect compromises early, and to investigate what occurred. 

As with software hosted in-house, services hosted in the cloud are also subject to security vulnerabilities.  Furthermore, unsecured APIs can open cloud resources to the risk of a breach.

Consider deploying a cloud app security broker (CASB) to help you identify all cloud apps that are in use, and enforce your organisation’s policies automatically. 

Enable MFA for access to cloud resources. Protect secrets, like keys to cloud resources, using tools designed to manage them (such as cloud-native password vaults). 

Only grant such access as is absolutely necessary for a user (principle of least privilege). Restrict resources to internal sharing, using group policies to prevent unwanted sharing with external parties. Cloud providers now offer tools to audit configuration settings and help reduce risks of unauthorised access. Set default permissions for data repositories to private, or an equally restrictive setting. 

Damage from unauthorised access can be reduced if data is encrypted.

If possible, send logs to your central repository. Set up rules to alert you of  significant changes to configuration or unusual download activity.

Many organisations benefit from external help to identify weaknesses in their cloud configuration.

XDR tools go one step beyond endpoint detection and response (EDR) tools, to monitor and detect certain attacks on cloud resources.

Preserve logs for cloud resources before they roll over. If you have centralized logs, protect them and preserve a copy.