Three main challenges of cloud infrastructure security

This excerpt from our resource, "Top 5 cloud infrastructure security best practices," can help you understand the common challenges that security professionals face when taking back control of the cloud attack surface.

Companies want to achieve a specific security outcome: spotting threats and stopping them before they cause harm. However, this task is becoming increasingly challenging. According to Forrester, the evolving nature of IT threats is the most common challenge cited by security decision makers.

Red Canary has detected a notable increase in cloud and identity-specific attack techniques in the past year, with T1218.004: Cloud Accounts rising from relative historical obscurity in our MITRE ATT&CK technique rankings to the fourth most prevalent such technique in the first six months of 2023. Your logical next move is clear: ensure you have visibility beyond the standard set of alerts generated by your cloud infrastructure, putting you in a position to observe, detect, and take action based on threats or suspicious activity. However, a new set of challenges arise: Looking at the alerts that come from your cloud infrastructure providers doesn’t provide you with the complete context of what’s happening. Those alerts only tell you that a user has modified a resource, which ends up raising more questions than providing answers. Even so, those detection signals you do receive contribute to the overall alert noise, making filtering difficult. Without effective detection and response strategies in place, you’re at risk of either not catching important signals or being inundated with false positives.

1.) Protecting the cloud with limited resources

Security operations teams are starting to understand the extra work required to protect the cloud. They are accountable for a widening attack surface that encompasses various domains such as containers, databases, identity, email, and more. Enterprise-wide monitoring of cloud resources is difficult considering the sprawling and ephemeral nature of how cloud workloads are deployed. With cloud environments, teams frequently leverage autoscaling or dynamic workloads spanning across global regions. The elastic nature of cloud infrastructure means that cloud workloads are constantly changing. Simply keeping track of these workloads becomes a technical difficulty on its own, and this challenge is compounded by the ever-shifting potential points of attack that these dynamic workloads can introduce. Simultaneously, security teams are assuming a growing responsibility in collaboration with IT to mitigate the risk of potential exposure or loss, all while ensuring that these measures do not slow down the pace of business operations.

The risks and costs of protecting their entire environment are putting a lot of pressure on resources that are already stretched thin.

2.) Protecting the cloud is more complex

Compared to traditional datacenter security, where your technology stack is often well-understood, cloud environments tend to have greater complexity. You may run virtual compute instances alongside containers and serverless functions or add an orchestration layer like Kubernetes. Amazon Web Services (AWS) alone offers over 200 different services for developers to use.

Considering the added complexity of cloud environments and the fact that more and more organizations are using the cloud for important business operations, cybercriminals have been quick to adapt. Adversaries are increasingly targeting cloud-hosted email, expanding their focus to cloud productivity applications such as Microsoft 365 and Google Workspace. This trend further extends to cloud Infrastructure as a Service (IaaS) environments like AWS and Microsoft Azure. Adversaries have placed high value on user account and API credentials, making them the prime target of numerous phishing campaigns.

Adding to this complexity is the fact that many organizations use multiple cloud providers. So it’s no surprise that security teams often don’t have the time or tools they need to handle the huge amount of data coming in and make sense of it all.

3.) Protecting the cloud introduces new identity-related risk and exposure

Identity is a foundational security domain that spans both traditional and cloud environments. Identity management is the core of security in the cloud, and you need to easily understand who can access your data or your infrastructure when using infrastructure-as-a-service (IaaS, such as Amazon Web Services or Microsoft Azure) or platform-as-a-service (PaaS, such as Salesforce). Cloud entitlements are permissions given to a cloud identity, which can be a human, machine, or service account. They define which cloud services a cloud user can access and their authority to use, create, modify, or delete resources within these services. It is critical to understand entitlements across your cloud environment so you can provide the necessary context to prioritize the most pressing risks, protecting your enterprise resources.

In the cloud, it’s important to monitor both user and service identities. Effective permissions and privilege policies are two important factors that help teams understand the bottom line of “who has access to what.” You will need a simple and scalable method to detect exposed secrets and lateral movement paths that might compromise sensitive assets. But this is easier said than done. Treating identity as a top priority for detection and response is a key challenge that security operations teams must address to effectively secure their environments.

According to Gartner, managing privileges in IaaS is getting even harder. Security and risk management leaders must combine traditional Identity and Access Management (IAM) approaches with Cloud Infrastructure Entitlement Management (CIEM) to achieve efficient identity-first security. CIEM is the process of managing identities and privileges in cloud environments. While these tools are often recognized as important components of an enterprise security stack, they alone don’t provide the complete picture necessary to respond quickly in case of a threat.

With these hurdles in mind, the pressing question becomes: how can security professionals continue to address these challenges while being more efficient with their time, money, and resources? What exactly do you need in terms of people, procedures, and technology to prevent a data breach?

Read our full resource, Top 5 cloud infrastructure security best practices, for a list of steps to improve detection and response for user protection, along with an executive-level overview of user protection security best practices.