Cloud apps are now the most common way digital attackers distribute malware. In the second quarter of 2021, researchers found that 68% of malware downloads originated from cloud apps, reported ZDNet. In order to keep your cloud security up, it’s important to know where problems might come from. Specifically, cloud-based misconfigurations could often be a contributing factor. Read on to learn what types of apps factored into these attacks.

Where Cloud Security Problems Start

According to a study by Netskope, most (66.4%) of malware instances in Q2 2021 started with cloud storage apps. They were followed by collaboration apps and development tools at 8.5% and 7.8%, respectively.

Meanwhile, infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) platforms accounted for the lowest proportion of malware downloads, at 3.1% for the quarter.

By using cloud apps, attackers can “bypass blocklists and take advantage of any app-specific allow lists.”

“Although attacks launched from the cloud are typically short-lived — the cloud service provider removes the malicious content when it is reported — attackers have illustrated that they can capitalize on the attack within the short time window that they have,” according to Netskope.

Cloud Complexity Can Lead to Problems

This amount of malware comes with an increasing rise in the number of cloud apps, the number of which used by enterprises increased 22% during the first half of 2021. Groups with upwards of 2,000 employees now use 805 distinct cloud apps.

With so many, it can be hard to manage those services. Sometimes, it’s a question of knowing that all those cloud apps exist in the first place. Per the study, 97% of the cloud apps were shadow IT that existed outside the purview of the IT department.

There’s also the issue of configuring all those apps in a way that aligns with security needs. Gartner predicted that 99% of all cloud security failures will be the customer’s fault through 2025. That’s the same proportion of IaaS misconfigurations that never get noticed, as shared by Help Net Security.

Cloud Security: How to Prevent Malware

The key is to have visibility over the cloud environments you use. So, many organizations are turning to cloud security posture management along with cloud-native security tools to gain it.

As part of their ongoing cloud journeys, organizations need to also develop security baselines for all their assets, including their cloud-based apps. It’s then up to them to align their assets to those baselines, monitor for configuration drift so that they can fix potential issues and update those baselines in a way that matches the evolving threat landscape.

More from News

Zombie APIs are a Top Security Concern as API Attacks Surge 400%

4 min read - Organizations of all sizes rely on application programming interfaces (APIs). The API explosion has been driven by several factors, including cloud computing, demand for mobile/web applications, microservices architecture and the API economy as a business model. APIs enable developers to access data remotely, integrate with other services, build modular applications and monetize their data/services. For enterprises that participated in a recent research study, the average number of APIs per organization was 15,564. Large enterprises (over 10,000 employees) had an average…

4 min read

Google’s Bug Bounty Hits $12 Million: What About the Risks?

4 min read - Bug bounty numbers have never been better. In 2022, Google rewarded the efforts of over 700 researchers from 68 different countries who helped improve the security of the company’s products and services. The total amount of awards grew from $8.7 million paid in 2021 to $12 million in 2022, a nearly 38% increase. Over the past few years, bug bounty programs have gained significant traction. Companies have been lured in by the potential to identify vulnerabilities quickly, enhance product security…

4 min read

Swiss Army Knife Malware Slices Through Systems In so Many Ways

4 min read - What if one single malware strain could cut through any security that tried to stop it? In a new study of more than 550,000 live malware strains, the Picus Red Report 2023 has unveiled a trove of over 5 million malicious activities. In the report, researchers identified the top tactics utilized by cyber criminals in 2022. Picus' findings also highlighted the growing prevalence of "Swiss Army knife malware". This type of malicious software is capable of executing a range of…

4 min read

Will Threat Actors Face Layoffs in 2023?

2 min read - You can’t look at the news these days without reading about layoffs in the technology sector. Roger Lee, founder of Layoffs.fyi told Investors.com that more than 120,000 tech employees lost their jobs in 2023 as of Feb 27, compared to 161,411 in all of 2022. However, all layoffs aren’t bad news. Most people don’t think of criminals losing their jobs. But if the criminal activity isn’t making money, then it makes no sense to continue. And that is happening in…

2 min read