According to the latest report from
Sysdig,
the leader in cloud security powered by runtime insights, the average
time from recon to attack completion is now only 10 minutes. Using
worldwide honeynets for the
2023 Global Cloud Threat Report,
the Sysdig Threat Research Team sheds light on an alarming truth:
Attacks in the cloud are lightning fast, with minutes determining the
line between detection and severe damage. It's clear that cloud
attackers are taking advantage of the same things that lure companies to
the cloud. While defenders need to protect their entire software life
cycle, attackers only have to be right one time, and automation is
making it even easier for them.
Key Findings
Cloud automation weaponized. Cloud attacks happen fast. Recon and
discovery are even faster. Automating these techniques allows an
attacker to act immediately upon finding a gap in the target system. A
recon alert is the first indication that something is awry; a discovery
alert means that the blue team is too late.
10 minutes to pain. Cloud attackers are quick and opportunistic, spending only 10 minutes to initiate an attack. According to Mandiant, the median dwell time on premises is 16 days, underlining the speed of the cloud.
A 90% safe supply chain isn't safe enough. 10% of advanced supply
chain threats are invisible to standard tools. Evasive techniques
enable attackers to hide malicious code until the image is deployed.
Identifying this type of malware requires runtime analysis.
65% of cloud attacks target telcos and fintech. Telecommunication
and finance companies are ripe with valuable information and offer an
opportunity to make quick money. Both industries are attractive targets
for fraud schemes.
What People are Saying
"The reality is, attackers are good at exploiting the cloud. It's not
just that they can script recon and autodeploy cryptominers and other
malware, but they take the tools that unleash the power of the cloud for
good and turn them into weapons. Abusing infrastructure-as-code to
bypass protective policies is one example," said Michael Clark, Director
of Threat Research at Sysdig.
"Cloud-native attackers are ‘everything-as-code' experts and automation
fans, significantly reducing their time to impact on the target systems
and increasing the potential blast radius. Open source detection-as-code
approaches like Falco are how blue teams can stay ahead in the cloud,"
said Alessandro Brucato, a Threat Research Engineer at Sysdig.