The emergence of cloud computing transformed the nature of IT ecosystems and infrastructure in many beneficial ways. From cost savings to flexibility to unparalleled scalability, the cloud’s advantages are well-documented. But it’s important not to overlook the fact that migrating to the cloud introduces many new points where unauthorized hackers can try to enter and launch a cyber-attack.

With many organizations having a growing portfolio of Internet-facing assets, cloud adoption is at least partially responsible for the increasingly important security discipline of external attack surface management. Read on to find out what a cloud attack surface is, the key threats to cloud security, and five tips for reducing your organization’s cloud attack surface.

What is a cloud attack surface?

Cloud computing provides organizations and individuals with the on-demand availability of computing resources via a private or public (Internet) network connection. Instead of having to provision and deploy resources on-premise, the cloud abstracts away those duties and lets you essentially rent out what you need for a fee.

The three main service models in modern cloud computing are:

Software as a Service (SaaS) – Third-party vendors deliver useful applications over the Internet for a subscription fee.

Infrastructure as a Service (IaaS) – Third-party cloud service providers deliver rentable infrastructure in the form of servers, networks, operating systems, and storage to customers vias a network connection.

Platform as a Service (PaaS) – Third-party cloud service providers deliver hardware and software tools as services for development teams interested in building, testing, deploying, and scaling custom applications.

Taking a look at these service models through the lens of an attack surface, a distinct characteristic is how the cloud shifts IT assets/resources from being confined to a secure on-premise perimeter to essentially being externally located assets. A cloud attack surface, therefore, is the total area of cloud-based IT resources that is susceptible to unauthorized entry.

The earliest recognizable example of cloud computing’s current service models came from the SaaS application Salesforce. Its founders formed the company in 1999 with the aim of delivering customer relationship management software via the Internet to users. By 2006, Amazon and Google followed suit with their own cloud offerings.

A time lag between the promise of the cloud and organizations willing to migrate workflows there meant that adoption didn’t really take off until the mid-2010s. By the end of the decade, more than 90 percent of organizations were in the cloud in some form. Recent trends such as hybrid workforces and Big Data analytics have only furthered the cloud’s appeal.

What are the biggest threats to cloud security?

Cloud computing unequivocally added to the challenges of keeping malevolent actors from hacking systems and stealing data. Availing of applications, platforms, and infrastructure via network connections entails expanding the attack surface to external-facing systems so that threat actors can probe for weaknesses far more easily than they can probe systems that are kept internal. Here is a brief run-through of some of the biggest threats to cloud security.

Misconfigurations

Working with the cloud involves a lot of tweaking and changing settings, each of which can potentially be configured in a way that puts the security of information or systems in jeopardy. These misconfigurations can come from simple human error or users lacking a basic understanding of cloud security principles and settings.

You don’t have to look far to unearth real-world examples of cloud misconfiguration threats. The Twitch breach of 2021 that led to hackers accessing 128 gigabytes of data stemmed from a cloud server misconfiguration that left the data exposed to hackers.

Compromised User Accounts

If you want users to interact with and use cloud resources, then you need to create and manage cloud user accounts. These user accounts provide a potential route into your systems and resources if threat actors can compromise them and abuse any privileges associated with them. And the risk of such a compromise is pretty substantial.

There are a plethora of ways to compromise a cloud account, including social engineering techniques that prey on psychological flaws, credential stuffing attacks that use stolen passwords from previous breaches to exploit users’ tendencies to reuse the same password for many accounts, and brute force attacks that crack weak passwords using algorithms.

Low Visibility

With resources moving outside the internal corporate/business network, maintaining full visibility over assets and systems is more difficult in the cloud. Given the rapid speed at which users can provision and deploy cloud resources, keeping track of everything is not feasible using the traditional asset management and network visibility tools that perform this role on-premise.

A common issue is users provisioning unsanctioned systems, devices, or applications without the oversight and approval of a central IT department. These so-called shadow IT resources can be left with serious security weaknesses without the organization ever knowing they exist until it’s too late.

API Security

Behind the complex multi-cloud strategy that many businesses run is an equally complex information-sharing ecosystem powered by application programming interfaces (APIs). These APIs allow different applications to interact with each other and with other back-end cloud resources managed by the service provider.

APIs face similar security threats to other web applications, such as broken authorization/authentication, insecure key generation, excessive data exposure, a lack of rate limiting, and more. Not properly securing these interfaces can provide a way for hackers to get into your environment and exploit the connectivity that APIs facilitate to other resources.

Top 5 tips to reduce your cloud attack surface

With these security threats in mind, let’s move on to five ways that you can reduce your cloud attack surface.

Conduct a cloud configuration security review

Regularly reviewing your cloud configurations is a useful way to identify and mitigate configuration-based vulnerabilities. Ideally, automation should come into play here with tools that scan cloud resources and identify the most common misconfigurations, including access controls, networking configs, cloud storage, and virtual machines. The need for automation is particularly salient when you consider that 80 percent of organizations said it takes more than 24 hours to perform a manual review of a single cloud application’s infrastructure-as-code configuration.

Implement Multi-Factor Authentication for business-critical SaaS and cloud services

One of the quickest wins in shrinking your cloud attack surface is hardening user accounts against the possibility of compromise. Adopting multi-factor authentication (MFA) is the best way to ensure that even if threat actors get their hands on a legitimate password, they can’t access the associated account without some other form of evidence.

Implement the principle of least privilege in the cloud

The principle of least privilege is a best practice for secure systems design that limits a user or program’s access to only the minimum set of privileges required for it to carry out its function or role. It’s critical to apply this practice across all facets of cloud computing, from configuring APIs to setting the permissions for user accounts. Applying this principle consistently reduces the risks from errors or compromises cascading into the abuse of privileges and the eventual access to sensitive data or takedown of critical systems.

Deploy proper network segmentation and security processes

Modern attack surface reduction requires a defense-in-depth approach to prevent the possible spread of malware or other forms of cyber-attack. Defense-in-depth means using many layers of security throughout a system. Network segmentation is an important part of cloud attack surface reduction that controls the traffic that moves between cloud resources, the internet, and on-premise. Stateful firewalls, often available as a service, can prove valuable in scaling network segmentation to the cloud, reducing the attack surface by accounting for the state and context of connections.

Reduce the number of publicly available resources

It might sound simple, but simply reducing the number of resources that are accessible via public Internet connections is another effective way to shrink your cloud attack surface. Leading public cloud providers have options for virtual private networks that enable remote workforces to securely access resources over a private connection. Any cloud-stored data should have its access controlled rather than being accessible to anyone with the correct URL. Of course, reducing publicly available resources does require full visibility into your cloud environments.

How to reduce your cloud attack surface with Bugcrowd

A good External Attack Surface Management tool should have the ability to include cloud in-scope, because the last thing we all need is another siloed solution. It’s a best practice to combine all EASM under one tool. Bugcrowd’s External Attack Surface Management features asset discovery, vulnerability management insights, security alerts, the ability to connect to your cloud environment, integrated penetration testing, and automated retesting.

To help manage your cloud attack surface effectively, you can integrate with AWS, Azure and GCP to scan and monitor public facing assets. You can see changes and vulnerabilities in your cloud attack surface complete with a full description, evidence and remediation advice to speed up remediation efforts.

Frequently Asked Questions