Trend Micro reveals misconfigurations are No. 1 cause of cloud security issues

Trend Micro has today revealed findings from its recent research into cloud security, highlighting the roles of human error and complex deployments in ushering in potential avoidable cyber threats.

Multi and hybrid-cloud IT strategies are fast becoming the norm for mid to large organisations across the world, such that Gartner recently predicted that 75% of organisations in this range will employ these strategies.

And as recent history tells us, as IT systems become more prevalent and popular, so too do the scope of threats facing them. Cloud platforms today are no different.

The research released today by Trend Micro indicates that misconfigurations are the primary cause of cloud security issues.

The company says it identifies 230 million misconfigurations on average each day – proof, it says, that this risk is prevalent and widespread.

"Cloud-based operations have become the rule rather than the exception, and cybercriminals have adapted to capitalise on misconfigured or mismanaged cloud environments," says Trend Micro vice president of cybersecurity Greg Young.

"We believe migrating to the cloud can be the best way to fix security problems by redefining the corporate IT perimeter and endpoints.

"However, that can only happen if organisations follow the shared responsibility model for cloud security. Taking ownership of cloud data is paramount to its protection, and we're here to help businesses succeed in that process."

The research found threats and security weaknesses in several key areas of cloud-based computing, potentially putting credentials and company secrets at risk.

Criminals capitalising on misconfigurations in these areas have subsequently targeted companies with ransomware, cryptomining, e-skimming and data exfiltration, according to Trend Micro.

The report also found tutorials purporting to have expertise on credential and authentication security have instead misled employees and IT teams, which Trend Micro says has led to mismanaged cloud credentials and certificates.

IT teams can take advantage of cloud-native tools to help mitigate these risks, but they should not rely solely on these tools, the report concludes.

• Employ least privilege controls: restricting access to only those who need it.
   
• Understand the Shared Responsibility Model: Although cloud providers have built-in security, customers are responsible for securing their own data.
   
• Monitor for misconfigured and exposed systems: Tools like Conformity can quickly and easily identify misconfigurations in your cloud environments.
   
• Integrate security into DevOps culture: Security should be built into the DevOps process from the start.