Nearly 80 percent of large enterprises say they have been hit by application attacks against their cloud-based systems, according to research from a security firm. This new data suggested the problem has increased 45 percent since last year.
Alert Logic’s study consisted of a huge sample size of more than 3,000 companies and 1 billion IT security incidents. It said application attacks were most widely reported in sectors such as retail, advertising, real estate and transportation, among others. There was also evidence that organizations that used the Web for online transactions with customers were among the key targets.
As Computer Business Review pointed out, the rise of application attacks in cloud-based systems doesn’t mean organizations that use on-premises software deployments are any safer; cybercriminals are still targeting more traditional environments. But as hosted data becomes more popular within the enterprise, cybercriminals are aiming at the cloud with greater frequency. In fact, the size of a company’s cloud footprint, so to speak, could be a good way of assessing its level of risk from third parties.
One of the report’s recommendations for fending off application attacks and other cloud threats is by using Lockheed Martin’s Cyber Kill Chain. For those who aren’t familiar with it, Dark Reading offered a comprehensive and critical analysis of this seven-step process for describing how cybercriminals work. It may be worth at least walking through this model to start a more nuanced discussion around securing critical data in the cloud.
The Web Host Industry Review noted the study’s suggestion that CISOs and their teams also must distinguish between securing the way users might leave their organization open to application attacks and investments in network monitoring or other mechanisms to safeguard IT infrastructure. A holistic approach to securing the cloud will probably need top-level support, and this data could be a way to help educate executives about the potential dangers.
In fact, the biggest mistake organizations might make, says Computing, is to assume that securing hosted software and data is the responsibility of cloud providers. As application attacks continue to grow in volume, businesses need to make sure they’re continuing to own risk management no matter where those applications run.