Industry executives and experts share their predictions for 2022.  Read them in this 14th annual VMblog.com series exclusive.

The Hackers Are Coming for Your Keys

By Josh Stella, Founding CEO, Fugue

Right now, security teams at organizations around the world are working overtime to stamp out Log4Shell – a zero-day vulnerability in the ubiquitous Java logging framework Log4j. It’s a race against time, as hackers are busy using automation to sniff out instances of this vulnerability they can use to penetrate systems. But by looking at what hackers are actually doing once they’ve exploited a Log4Shell vulnerability, we see what they’re really after: our cloud API keys.

That’s because Log4Shell – along with every current and future CVE – is simply a means to much bigger and more damaging ends. Hackers are out to do real damage, like steal or ransom sensitive data, and component-level vulnerabilities alone don’t give them this power. These vulnerabilities provide a hacker access to a system component, but that’s not what they’re ultimately after (I’m referring only to malicious hackers here, not white hats we all rely on every day).

At Fugue, a cloud security SaaS company I founded and lead, I’ve published in-depth analyses of major cloud breaches to understand how hackers think. The bottom line is that they want our API keys and access to the cloud control plane. This is where they can discover knowledge about our environments, move laterally, and steal data right out from under our security tooling without detection. All of the thousands of CVEs, along with all of the known-bad cloud resource misconfiguration mistakes that we can make, are just jumping-off points for hackers. But unfortunately, this is where most security teams are focused.

We predict that the frequency of significant breaches involving cloud control plane compromise will increase in 2022, and the damage incurred will be greater than anything we’ve seen before.

Every Major Cloud Breach Involves Control Plane Compromise

If we take a closer look at modern cloud breaches, our prediction looks more like a lock than a long shot. With every one that’s made headlines, control plane compromise is central to the plot. It’s how a single misconfigured server at Twitch allowed a hacker to access thousands of sensitive code repositories at Twitch – and at parent Amazon. A firewall misconfiguration gave a hacker entry to Capital One’s AWS environment, but it was her ability to get API keys that enabled her to ultimately find and extract sensitive customer data without detection.

I use Twitch and Capital One as examples, not to single them out as being poor at cloud security. In fact, it’s just the opposite. Amazon has a stellar security track record. Capital One has been a real trailblazer on cloud security for years. Their breaches must serve as a warning to everyone. If it can happen to them, what are your chances?

The game is lopsided because hackers are the true experts in cloud security at what they need to know. They know far more about ways to compromise your cloud control plane than security teams know how to stop them. And they’ll use that knowledge to inflict maximum damage in the form of stolen data, cryptomining and ransomware – all while security plays a hopeless game of whack-a-mole with CVEs.

Security Hasn’t Caught Up to the Cloud

“The cloud is just someone else’s data center” is a trope, but it wasn’t that far off when cloud servers, networks and firewalls looked a lot like the physical ones they replaced. Those days are long gone. Today, enterprise cloud environments are intricate systems composed of hundreds of thousands of components, including VMs, containers, serverless functions, object storage and database services, and utilities.

Every one of these resources has their own access configurations and identity and access management (IAM) roles and policies, which serve as the modern cloud network (traditional TCP/IP networks aren’t as central to cloud systems). Understanding this vast and complex resource graph and attack surface is job number one of overstretched cloud security teams who have limited visibility into everything that’s running, let alone how it’s all connected and how it’s all changing.

The hacker’s job is a whole lot easier. They don’t need to know everything about an environment in order to do damage, but rather, just enough. And they’re really good at using the API keys they get from one resource to get access to discover what they need and get it. They don’t even need database passwords when they can just steal a snapshot. If their actions result in some suspicious-looking logging events, will the security teams notice before the hacker is long gone?

Where Cloud Security Is Headed in 2022

The trend toward bigger and more damaging cloud breaches involving control plane compromise isn’t going to reverse any time soon, so expect more headlines in 2022.

Cloud security teams that focus on the security of their cloud systems as a whole, and not just on component-level security, have a leg up on preventing these kinds of breaches in 2022 and beyond. They better understand their cloud attack surface and how to spot dangerous IAM configurations. They’re equipping developers with policy as code tooling that tells them when they’re creating dangerous vulnerabilities and helps them design systems that are more inherently secure.

When designed with security in mind, cloud-based systems can be made highly resilient to component-level exploits, and resource misconfigurations, CVEs, and zero days like Log4Shell have little impact on your security posture.

##

ABOUT THE AUTHOR

Josh Stella is founding CEO of Fugue and a technical authority on cloud security in highly regulated enterprises. Bringing 25 years of expertise as a startup CTO, principal solutions architect at Amazon Web Services, and advisor to intelligence agencies, Josh helps organizations like Blue Cross and AT&T run faster in the cloud – without breaking rules. He is a technology patent holder, book author, and educator who conducts master classes that guide enterprises on how to deploy low-code, automated policy tools on Amazon Web Services, Microsoft Azure, and Google Cloud platforms, gaining confidence and trust from business leaders, regulators and consumers. Connect with Josh on LinkedIn and via Fugue at www.fugue.co.