Industry executives and experts share their predictions for 2021. Read them in this 13th annual VMblog.com series exclusive.
Cloud Security Is Going to Get Worse Before It Gets Better, but it will get Better
By Jeremy Snyder, Senior Director of Business Development and Solution Engineers, Cloud Security at Rapid7
With what felt like an overnight shift to remote work earlier this year, we witnessed enterprises spanning all industries accelerate or begin their cloud migration journey. Naturally, with so many organizations in the beginning stages of their cloud journey, security was not prioritized or considered as much as it should have been.
As we enter a New Year, I have a lot of thoughts on what is ahead for cloud security. To start, while we’ve seen an acceleration of cloud adoption and migration stemming from the pandemic, cloud security is likely going to get worse before it gets better. When thinking about cloud adoption as a bell curve shaped distribution, many companies are still in the early stages of harnessing the potential of the cloud. During these early stages, security is often not something companies consider as their top priority, as they are more focused on migrating quickly vs. securely.
As cloud adoption becomes more mainstream, we will see more repetitions of mistakes made in the past. For example, databases, storage containers, and other cloud services being configured incorrectly, along with permissions being too broad, allowing anyone access. In order for this to change, we will see more cloud-related breaches and attacks, as relatable events tend to trigger changes in behavior.
In 2020, we saw an increase in cloud data breaches due to the mere influx of cloud usage among enterprises, however we can expect security events in the coming year to become more complex. In 2021, we can expect these attacks to be more sophisticated, going beyond the first level of defense with attackers leveraging one exploit to get to another vulnerability to ultimately get to a data source. Expect to see more multi-vector and multi-authentication attacks.
This trend will partially be driven by how much attention cloud-based attacks received in 2020 and how detailed the reports were about the intricacies of these attacks. Such in-depth analysis and reporting almost serves as a playbook for bad actors. When you explain all the steps in processes like this, we see a lot more bad actors taking advantage of that understanding. Because many have mastered these initial attacks, attackers will start to build off what has been done in the past to access databases.
Finally, in 2021, we will see cloud service providers working together more. For example, Microsoft will expand its Azure Security Center to ingest findings from other clouds. Today, it is widely understood that organizations need to have a unified view of their cloud security posture, as it enables them to implement and deploy advanced threat protection across workloads running in various clouds and on-premises. Collaboration among the cloud service providers supports this need for a unified view.
The strengthening of multicloud security will set enterprises up with a stronger defense. We’ve already begun to see cloud service providers take on more of a role in security collaboration recently, including Google Cloud’s partnership with Thales. In the year ahead, we anticipate that these collaborative relationships will continue to surface among the major cloud service providers, acknowledging their responsibility to better protect their shared customers.
2020 was a wild year for cloud security, and I have a feeling there is a lot more to come.
##
About the Author
Jeremy Snyder is the Senior Director of Business Development and Solutions Engineering for the Cloud Security Practice at Rapid7. He leads the company’s solutions architect, partner and international teams. With prior experience at AWS (first field representative in Southeast Asia’s ASEAN region) and REAN Cloud (later Hitachi Vantara), Jeremy’s been working in the cloud since 2010. He has a BA (Ling) from UNC and an MBA GMU. Jeremy has lived in five countries and speaks several languages.
