Cloud apps are now the most common way digital attackers distribute malware. In the second quarter of 2021, researchers found that 68% of malware downloads originated from cloud apps, reported ZDNet. In order to keep your cloud security up, it’s important to know where problems might come from. Specifically, cloud-based misconfigurations could often be a contributing factor. Read on to learn what types of apps factored into these attacks.

Where Cloud Security Problems Start

According to a study by Netskope, most (66.4%) of malware instances in Q2 2021 started with cloud storage apps. They were followed by collaboration apps and development tools at 8.5% and 7.8%, respectively.

Meanwhile, infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) platforms accounted for the lowest proportion of malware downloads, at 3.1% for the quarter.

By using cloud apps, attackers can “bypass blocklists and take advantage of any app-specific allow lists.”

“Although attacks launched from the cloud are typically short-lived — the cloud service provider removes the malicious content when it is reported — attackers have illustrated that they can capitalize on the attack within the short time window that they have,” according to Netskope.

Cloud Complexity Can Lead to Problems

This amount of malware comes with an increasing rise in the number of cloud apps, the number of which used by enterprises increased 22% during the first half of 2021. Groups with upwards of 2,000 employees now use 805 distinct cloud apps.

With so many, it can be hard to manage those services. Sometimes, it’s a question of knowing that all those cloud apps exist in the first place. Per the study, 97% of the cloud apps were shadow IT that existed outside the purview of the IT department.

There’s also the issue of configuring all those apps in a way that aligns with security needs. Gartner predicted that 99% of all cloud security failures will be the customer’s fault through 2025. That’s the same proportion of IaaS misconfigurations that never get noticed, as shared by Help Net Security.

Cloud Security: How to Prevent Malware

The key is to have visibility over the cloud environments you use. So, many organizations are turning to cloud security posture management along with cloud-native security tools to gain it.

As part of their ongoing cloud journeys, organizations need to also develop security baselines for all their assets, including their cloud-based apps. It’s then up to them to align their assets to those baselines, monitor for configuration drift so that they can fix potential issues and update those baselines in a way that matches the evolving threat landscape.

More from News

The White House on Quantum Encryption and IoT Labels

A recent White House Fact Sheet outlined the current and future U.S. cybersecurity priorities. While most of the topics covered were in line with expectations, others drew more attention. The emphasis on critical infrastructure protection is clearly a top national priority. However, the plan is to create a labeling system for IoT devices, identifying the ones with the highest cybersecurity standards. Few expected that news. The topic of quantum-resistant encryption reveals that such concerns may become a reality sooner than…

Malware-as-a-Service Flaunts Its Tally of Users and Victims

As time passes, the security landscape keeps getting stranger and scarier. How long did the “not if, but when” mentality towards cyberattacks last — a few years, maybe? Now, security pros think in terms of how often will their organization be attacked and at what cost. Or they consider how the difference between legitimate Software-as-a-Service (SaaS) brands and Malware-as-a-Service (MaaS) gangs keeps getting blurrier. MaaS operators provide web-based services, slick UX, tiered subscriptions, newsletters and Telegram channels that keep users…

New Survey Shows Burnout May Lead to Attrition

For many organizations and the cybersecurity industry as a whole, improving retention and reducing the skills gap is a top priority. Mimecast’s The State of Ransomware Readiness 2022: Reducing the Personal and Business Cost points to another growing concern — burnout that leads to attrition. Without skilled employees, organizations cannot protect their data and infrastructure from increasing cybersecurity attacks. According to Mimecast’s report, 77% of cybersecurity leaders say the number of cyberattacks against their company has increased or stayed the…

Alleged FBI Database Breach Exposes Agents and InfraGard

Recently the feds suffered a big hack, not once, but twice. First, the FBI-run InfraGard program suffered a breach. InfraGard aims to strengthen partnerships with the private sector to share information about cyber and physical threats. That organization experienced a major breach in early December, according to a KrebsOnSecurity report. Allegedly, the InfraGard database — containing contact information of over 80,000 members — appeared up for sale on a cyber crime forum. Also, the hackers have reportedly been communicating with…