Tenable Cloud Security Study Reveals a Whopping 95% of Surveyed Organizations Suffered a Cloud-Related Breach Over an 18-Month Period
The finding from the Tenable 2024 Cloud Security Outlook study is a clear sign of the need for proactive and robust cloud security. Read on to learn more about the study’s findings, including the main challenges cloud security teams face, their strategies for better protecting their cloud infrastructure and the tools they use to measure success.
Tenable has just published its "2024 Cloud Security Outlook" report, our annual assessment of organizations’ perceptions and experiences in securing their public cloud environments. The report, which polled 600 cloud security professionals in North America and Europe, explores the issues plaguing the respondents, the priorities they’ve set to address these challenges and the tools they’re using to measure success. We hope the report helps you understand how your peers are tackling cloud-environment complexity so you can set a strategic, effective path for securing yours.
Check out key highlights from the report below.
Cloud breaches are pervasive, with insecure identities the leading culprit
Each year, the study probes how many respondents are affected by cloud-related breaches. We’re always optimistic. One might think that the huge growth in cloud-security awareness and tooling options would have by now triggered a downward trend in – or at least some immunity to – breaches. Alas, we found that a discomforting 95% of the 600 organizations polled had experienced cloud-related breaches in the previous 18 months. Among those, somewhat predictably, 92% reported exposure of sensitive data, and a majority acknowledged being harmed by the data exposure.
Given that in the cloud world breaches seem unavoidable, it makes sense that cloud security platforms seek to not just flag vulnerable points of entry but also minimize a hacker’s ability to do harm once in. We were therefore curious about what cloud security professionals perceive as their greatest source of risk – workload vulnerabilities, ransomware attacks, third party access? Here, perception aligned with the most recent industry understanding: Respondents cited insecure cloud identities and misconfigurations as their leading security risks – and 99% of organizations that experienced cloud-related breaches placed the blame on insecure identities as the leading cause.
We drilled down into identities and access to see if organizations are not only aware of insecure identity and access management (IAM) as public enemy #1 for cloud security, but if they are doing something about it. Here respondents scored top marks, with many prioritizing efforts to minimize permissions through zero trust, access governance and just-in-time (JIT) initiatives.
More key findings
The report focused on three angles in securing cloud infrastructure and, in particular, governing access to resources:
- It’s Just So Hard. We asked organizations to break down the key barriers, challenges and risks they are encountering as they implement their cloud security programs.
- Of Utmost Importance. We sought to understand which of the many security areas and initiatives they are prioritizing in the year – and if those priorities line up with the reported top risks.
- Measuring Tells No Lies. Hand in hand with evaluating cloud security progress and maturity, not to mention justifying budget for renewals and new solutions, are performance indicators. We looked at the measurement tools in use and at those used the most.
Other important findings included:
- Lack of remediation capabilities is the top barrier to implementing new cloud security capabilities.
- Lack of cloud security expertise isn’t just “analyst speak” – it’s a reality that’s putting organizations at risk.
- A substantial degree of uncertainty exists regarding who within the organization owns responsibility for cloud security.
Regional differences
The findings revealed several regional disparities, including which region was more inclined to report experiencing no cloud-related breaches (spoiler: North America). We also saw regional differences in breaches’ causes. EU organizations were much more likely to pin their cloud breaches on excessive permissions and difficulty in detecting toxic combinations than their North American counterparts.
Regional differences also surfaced regarding the influence of DevOps teams on respondents’ ability to implement new cloud security capabilities. Significantly more respondents in North America than in Europe cited as a barrier the fear of DevOps teams that security efforts would disrupt their workflow.
Get the report!
Hopefully this blog has whetted your appetite for cloud security insights and best practices. We invite you to download the report, which will offer you:
- A good idea of the prevalence of cloud related breaches and the degree to which sensitive data is not just exposed but having negative impact
- An understanding of the pains and blockers that concern cloud security professionals globally and regionally, and what issues are common to all
- Insight into what others are prioritizing to tackle their concerns, to help shortcut your way to priorities that can help make your cloud security efforts more effective
Learn more:
- Download the "2024 Cloud Security Outlook" report
- Attend the webinar "Tenable Shares Its 2024 Cloud Security Outlook: Winning Half the Battle by Understanding Barriers and Priorities"
- Read the white paper "Holistic Security for AWS, GCP and Azure"
Related Articles
New AWS Control Policy on the Block
November 18, 2024AWS has released an important new feature that allows you to apply permission boundaries around resources at scale called Resource Control Policies (RCPs). Read on to learn what RCPs are all about and how to use them, as well as how Tenable Cloud Security already factors them into its analysis.
The Dark Side of Domain-Specific Languages: Uncovering New Attack Techniques in OPA and Terraform
November 18, 2024Check out our deep dive into both new and known techniques for abusing infrastructure-as-code and policy-as-code tools. You’ll also learn how to defend against them in this blog post which expands on the attack techniques presented at our fwd:cloudsec Europe 2024 talk “Who Watches the Watchmen? Stealing Credentials from Policy-as-Code Engines (and beyond).”
Cybersecurity Snapshot: Five Eyes Rank 2023’s Most Frequently Exploited CVEs, While CSA Publishes Framework for AI System Audits
November 15, 2024Check out the CVEs attackers targeted the most last year, along with mitigation tips. Plus, a new guide says AI system audits must go beyond check-box compliance. Meanwhile, a report foresees stronger AI use by defenders and hackers in 2025. And get the latest on cloud security, SMBs' MFA use and the CIS Benchmarks.
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
Volt Typhoon: U.S. Critical Infrastructure Targeted by State-Sponsored Actors
November 19, 2024Volt Typhoon, a state-sponsored actor linked to the People’s Republic of China, has consistently targeted U.S. critical infrastructure with the intent to maintain persistent access. Tenable Research examines the tactics, techniques and procedures of this threat actor.
CVE-2024-0012, CVE-2024-9474: Zero-Day Vulnerabilities in Palo Alto PAN-OS Exploited In The Wild
November 18, 2024Palo Alto Networks confirmed two zero-day vulnerabilities were exploited as part of attacks in the wild against PAN-OS devices, with one being attributed to Operation Lunar Peek.
- Cloud
- Cloud