Cloud computing has continually changed how various organizations use, store, and share data, applications, and workloads. However, this has also introduced a number of new security threats and challenges; and with large amounts of data going into the cloud, these resources become natural targets for cyber attacks.

“The volume of public cloud utilization is growing rapidly, so that inevitably leads to a greater body of sensitive stuff that is potentially at risk,” said Jay Heiser, vice president and cloud security lead at Gartner, Inc.

According to Cloud Security Alliance (CSA) in its latest version of its Treacherous 12 Top Threats to Cloud Computing Plus: Industry Insights report, organizations need to be provided with an up-to-date understanding of cloud security threats so as to make informed decisions regarding cloud adoption strategies.

CSA conducted a survey of industry experts to compile professional opinions on the greatest, most significant security threats within cloud computing for 2018.

1.  Data breaches

According to the report, data beaches are either the main objective of a targeted attack or just the result of human errors, application vulnerabilities, or improper security measures. It involves the exposure of any kind of information not intended for public release, such as personal health records, financial data, personality identifiable information, insider trade secrets and intellectual property.

Data breaches are not unique to the cloud computing industry, but it consistently ranks highest during cloud customer complaints. Therefore, it is important to patronize reputable providers such as Umbrellar Cloud service.

2.  Insufficient identity, credential, and access management

“Bad actors masquerading as legitimate users, operators, or developers can read, modify, and delete data; issue control plane and management functions; snoop on data in transit or release malicious software that appears to originate from a legitimate source,” said CSA.

This results in insufficient identity, credential, or key management enabling unauthorized access to data and causing potential massive damage to organizations or end users.

3.  Insecure interfaces and application programming interfaces (APIs)

Cloud service providers expose sets of software user interfaces (UIs) or application programming interfaces (APIs) that customer utilize to manage and interact with cloud services. Performed with these interfaces are provisioning, management, and monitoring; and the security and availability of general cloud services are dependent on the level of security of APIs, says CSA.

APIs need to be designed in such a way that it protective against accidental and malicious attempts to avoid policy.

4.  System vulnerabilities

According to the report, “System vulnerabilities are exploitable bugs in programs that attackers can use to infiltrate a system to steal data, taking control of the system or disrupting service operations.”

Vulnerabilities present within the components of the operating system have placed the security of all services and data at significant risk. Multi-tenancy in the cloud causes systems from various organizations to be place close to each other, giving room to shared memory resources, which in turn leads to newer attack surfaces.

5.  Account hijacking

Account or service hijacking is not new to the internet, but then cloud services poses a new threat to the landscape. If attackers can gain access to a user’s credentials, they can easily eavesdrop on activities and transactions, manipulate data, return falsified information and redirect clients to illegitimate sites.

Account or service threats may become a new base for attackers in 2018. The stolen credentials can be utilized by attackers to access critical areas of cloud computing services, allowing them to jeopardize the confidentiality, integrity, and availability of those services.

6.  Malicious insiders

A malicious insider such as a system administrator has access to potentially sensitive information, and can have higher levels of access to more critical systems and eventually to data. Therefore, systems that depend entirely on cloud service providers for security are at bigger risk.

“While the level of threat is open to debate, the fact that insider threat is a real adversary is not,” CSA said.

7.  Advanced persistent threats (APTs)

“APTs are a parasitical form of cyber attack that infiltrates systems to establish a foothold in the IT infrastructure of target companies, from which they steal data,” said the report.

APTs achieve their goals stealthily over long periods of time, often adapting to the security measures intended to defend against them. Once successfully placed, APTs can move laterally through data center networks and blend in with normal network traffic to achieve their malicious objectives.

8.  Data loss

According to CSA, “Data stored in the cloud can be lost for reasons other than malicious attacks.”

Numerous reasons can be responsible for this threat—with instances such as an accidental deletion by the cloud service provider, or physical catastrophes like fire or earthquake—which can cause a permanent loss of customer data unless adequate measures were taken by the provider or cloud consumer to back up data.

9.  Insufficient due diligence

During the creation of e business strategies by executives, cloud technologies and service providers must be considered.

“Developing a good roadmap and checklist for due diligence when evaluating technologies and providers is essential for the greatest chance of success,” said CSA.

Organizations that hastily adopt cloud technologies and choose providers without carefully carrying out due diligence, leave themselves exposed to a great number of risks.

10.  Abuse and nefarious use of cloud services

“Poorly secured cloud service deployments, free cloud service trials, and fraudulent account sign-ups via payment instrument fraud expose cloud computing models to malicious attacks,” said CSA. “Bad actors might leverage cloud computing resources to target users, organizations, or other cloud providers.”

There are various ways in which cloud-based resources are misused, such as launching distributed denial-of-service (DoS) attacks, email spams, and numerous phishing campaigns.