Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

1/14/2021
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Businesses Struggle with Cloud Availability as Attackers Take Aim

Researchers find organizations struggle with availability for cloud applications as government officials warn of cloud-focused cyberattacks.

The majority of organizations have separate tools for networking and security, researchers report in a new survey on cloud and networking challenges. Their findings emerge as US government officials warn businesses of successful attacks on corporate cloud services. 

Related Content:

More SolarWinds Attack Details Emerge

How Data Breaches Affect the Enterprise

New From The Edge: Understanding TCP/IP Stack Vulnerabilities in the IoT

Barracuda Networks today published a survey conducted by Censuswide, which polled more than 800 IT decision makers responsible for cloud infrastructure. The majority – 69% in the US and 56% overall – struggle to ensure availability and always-on access to cloud applications for employees. Most of the businesses say they're challenged with latency, downtime, and cost.

"The Internet is the core utility for us to get our day-to-day work done," says Sinan Eren, vice president of zero-trust access at Barracuda. "It's tougher for organizations to leverage the public Internet and grow their base of employees accessing these solutions on a daily basis."

Nearly 70% experience latency and performance issues running software-as-a-service (SaaS) workloads such as Office 365, researchers report, a trend they anticipate will continue. As businesses grow more dependent on the cloud, they encounter a number of constraints. Downtime is a constant issue; lack of bandwidth is a common complaint. Organizations using a traditional network that backhauls traffic through a centralized data center find users and networks suffer from latency.

The cost of network infrastructure has proved a hurdle for businesses working to fix the problem. More than 70% use traditional access methods, such as multiprotocol label switching (MPLS) in their networks. At least 60% say their MPLS costs significantly increase with seasonal workload peaks, while a similar number say they think MPLS lines are pricey and inflexible for their business needs. 

"It does take a tremendous amount of investment to improve these workloads and improve the efficiency, performance, and latency," Eren says. 

Most companies have historically used dedicated lease lines, such as MPLS lines, to interconnect network infrastructure, researchers note. These leases are typically long-term and don't scale up or down, often resulting in a mismatch in capacity. Organizations often find they're paying more than they should for capacity they may not necessarily need all the time. 

Of the businesses surveyed, 86% have separate products that specifically focus on networking or security. Around the same amount believe security should be incorporated throughout the network, not only applied at the data center, and 70% say security is a primary concern for the organization when deploying an SD-WAN tool.

Dark Clouds Ahead
The cloud-related challenges companies face set a concerning stage for an alert published this week by the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA). US officials warn of "several recent successful cyberattacks against various organizations' cloud services," done by attackers exploiting poor cyber hygiene practices within a victim's cloud services configuration. 

These attacks frequently occurred when a target organization's employees worked remotely and used a combination of corporate and personal devices to access cloud services, CISA states. Despite the use of security tools, poor user practices paved the way for successful attacks.

Attackers used a variety of techniques – phishing, brute force login attempts, and possibly a "pass the cookie" attack – to breach cloud services. CISA warns of phishing emails with links to harvest credentials for cloud service accounts. With these credentials, the attackers were able to log in and send emails from the target user's account to other accounts in the same business.

In several instances, they say, attackers collected sensitive data by abusing email forwarding rules that employees had set up to send business emails to their personal accounts. In one, they modified an email rule to redirect emails to an account controlled by the attackers. In some cases, attackers created new mailbox rules to forward specific emails with phishing-related keywords to the victim's RSS Feeds or Subscriptions folder so as to hide warnings.

These attackers successfully breached one user protected with multifactor authentication. They attempted brute force logins on some accounts, which were unsuccessful, officials say. In response to the attacks detailed in the alert, CISA has compiled an extensive list of steps that organizations can take to strengthen their cloud security practices.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26788
PUBLISHED: 2021-03-08
Oryx Embedded CycloneTCP 1.7.6 to 2.0.0, fixed in 2.0.2, is affected by incorrect input validation, which may cause a denial of service (DoS). To exploit the vulnerability, an attacker needs to have TCP connectivity to the target system. Receiving a maliciously crafted TCP packet from an unauthentic...
CVE-2021-23351
PUBLISHED: 2021-03-08
The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in ...
CVE-2009-20001
PUBLISHED: 2021-03-07
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.