Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

8/15/2017
01:14 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Alert Logic Releases 2017 Cloud Security Report

On-Premises Workloads Experience 51% Higher Rate of Security Incidents than Applications Running on Public Cloud Platforms

Houston – Alert Logic, provider of Security-as-a-Service solutions for the cloud, today announced the availability of its 2017 Cloud Security Report. The report analyzes customer data from more than 3,800 Alert Logic cloud, on-premises and hybrid cloud customers over an 18-month period, from Aug. 1, 2015, to Jan. 31, 2017.  Report findings are based on an analysis of more than 2 million security incidents captured in Alert Logic intrusion detection systems and escalated by Alert Logic Security Operations Center (SOC) analysts to its customers over 555 days, 32.5 million events associated with those incidents, and 147 petabytes of security data.

"We focused our analysis on incident types and the workloads and environments most at risk," said Misha Govshteyn, senior vice president of technical and product marketing. "Cyber attackers continue to seek the weakest spots in network defenses and businesses need to understand how they are refocusing to take advantage of the changing attack landscape."

The Alert Logic customers in the report data set represent a broad range of industries (452 unique SIC codes) and organization sizes, from small-to-medium-sized businesses to large-scale enterprises.  82 percent of customer deployments analyzed hosted workloads in the cloud – either on an Infrastructure-as-a-Service platform or hosted private cloud – and approximately one-third maintained on-premises or cloud hybrid infrastructure.

While the report focuses predominately on OWASP Top 10 attack methods, three other significant categories of attack methods targeting Alert Logic customers are examined. These include brute-force attacks, server-side ransomware and undesirable outside reconnaissance.

Some of the top findings in the report include the following:

 

  • Web applications are the soft underbelly of organizations. Web application attacks accounted for 73 percent of all the incidents flagged in the 18-month evaluation period. Web application attacks affected 85 percent of all Alert Logic customers, with injection-style attacks such as SQL injection leading the pack.

 

  • Pure public cloud installations experienced the fewest security incidents. On average, customers running applications on public cloud platforms experienced 405 security incidents over the 18-month period while on-premises customers experienced a 51% higher rate of security incident escalations (612), hosted private cloud 69% higher (684) and hybrid cloud 141% higher (977).
  • Server-side ransomware represented only 2% of total incidents. While ransomware gets much mindshare in the cyber security industry and in media headlines, it accounted for only a small number of observed security incidents in the data set.
  • Bad actors like content management systems and e-Commerce platforms.  Vulnerabilities in ubiquitous third-party web application components, insecure coding practices and increases in exploit automation make content management systems and e-Commerce platforms rich hunting grounds for hackers targeting web applications.  Attacks targeting Joomla accounted for 25% of total web application attacks observed followed by WordPress with 10% and Magento with 7%.

The report also examines five industry verticals – Finance Services and Insurance; Health Services; Information Technology and Services; Production, Manufacturing, and Logistics, and Retail and Accommodation – to pinpoint prevalent attack vectors and patterns within those sectors.

 

To download a full copy of the 2017 Cloud Security Report, visit here.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
7 Ways VPNs Can Turn from Ally to Threat
Curtis Franklin Jr., Senior Editor at Dark Reading,  9/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16695
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
CVE-2019-16696
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
CVE-2018-21018
PUBLISHED: 2019-09-22
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.
CVE-2019-16692
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.
CVE-2019-16693
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.