Identity and access issues topped the list of concerns of IT pros in the Cloud Security Alliance's annual Top Threats to Cloud Computing: The Pandemic 11 report released earlier this month. "Data breaches and data loss were the top concerns last year," says CSA Global Vice President of Research John Yeoh. "This year, they weren't even in the top 11."
"What that tells me is the cloud customer is getting a lot smarter," Yeoh continues. "They're getting away from worrying about end results—a data breach or loss is an end result—and looking at the causes of those results (data access, misconfigurations, insecure applications) and taking control of them."
That trend is indicative of cloud service providers (CSPs) doing a better job of upholding their end of the shared responsibility model, where the CSP is responsible for protecting its infrastructure while the cloud user is on the hook for protecting the data, applications, and access in their cloud environments, says Corey O’Connor, director of products at DoControl, a provider of automated SaaS security. "This puts more pressure on the organization consuming the service, as attackers naturally place a much bigger focus on them," he says. "This finding supports the narrative of organizations consuming cloud services needing to do everything they can to mitigate the risk of security events and data breaches. They need to do more to uphold their end of the model."
Here are the Pandemic 11 in order of importance.
Concerns about identity and access are foremost in the minds of cybersecurity pros, according to the CSA report. "Access is at the top of the list this year because protecting your data starts and ends with access," says Yeoh.
Forrester Vice President and Principal Analyst Andras Cser agreed. "Identity and access in a CSP's platforms are everything," he says. "If you have the keys to the kingdom, you can't just enter it but reconfigure it—a major threat to operational stability and security of any organization."
"Attackers no longer try to brute-force their way into enterprise infrastructure," adds Hank Schless, a senior manager for security solutions at Lookout, a provider of mobile phishing solutions. "With so many ways to compromise and steal corporate credentials, the preferred tactic is to pose as a legitimate user in order to avoid detection."