Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

1/14/2021
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Businesses Struggle with Cloud Availability as Attackers Take Aim

Researchers find organizations struggle with availability for cloud applications as government officials warn of cloud-focused cyberattacks.

The majority of organizations have separate tools for networking and security, researchers report in a new survey on cloud and networking challenges. Their findings emerge as US government officials warn businesses of successful attacks on corporate cloud services. 

Related Content:

More SolarWinds Attack Details Emerge

How Data Breaches Affect the Enterprise

New From The Edge: Understanding TCP/IP Stack Vulnerabilities in the IoT

Barracuda Networks today published a survey conducted by Censuswide, which polled more than 800 IT decision makers responsible for cloud infrastructure. The majority – 69% in the US and 56% overall – struggle to ensure availability and always-on access to cloud applications for employees. Most of the businesses say they're challenged with latency, downtime, and cost.

"The Internet is the core utility for us to get our day-to-day work done," says Sinan Eren, vice president of zero-trust access at Barracuda. "It's tougher for organizations to leverage the public Internet and grow their base of employees accessing these solutions on a daily basis."

Nearly 70% experience latency and performance issues running software-as-a-service (SaaS) workloads such as Office 365, researchers report, a trend they anticipate will continue. As businesses grow more dependent on the cloud, they encounter a number of constraints. Downtime is a constant issue; lack of bandwidth is a common complaint. Organizations using a traditional network that backhauls traffic through a centralized data center find users and networks suffer from latency.

The cost of network infrastructure has proved a hurdle for businesses working to fix the problem. More than 70% use traditional access methods, such as multiprotocol label switching (MPLS) in their networks. At least 60% say their MPLS costs significantly increase with seasonal workload peaks, while a similar number say they think MPLS lines are pricey and inflexible for their business needs. 

"It does take a tremendous amount of investment to improve these workloads and improve the efficiency, performance, and latency," Eren says. 

Most companies have historically used dedicated lease lines, such as MPLS lines, to interconnect network infrastructure, researchers note. These leases are typically long-term and don't scale up or down, often resulting in a mismatch in capacity. Organizations often find they're paying more than they should for capacity they may not necessarily need all the time. 

Of the businesses surveyed, 86% have separate products that specifically focus on networking or security. Around the same amount believe security should be incorporated throughout the network, not only applied at the data center, and 70% say security is a primary concern for the organization when deploying an SD-WAN tool.

Dark Clouds Ahead
The cloud-related challenges companies face set a concerning stage for an alert published this week by the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA). US officials warn of "several recent successful cyberattacks against various organizations' cloud services," done by attackers exploiting poor cyber hygiene practices within a victim's cloud services configuration. 

These attacks frequently occurred when a target organization's employees worked remotely and used a combination of corporate and personal devices to access cloud services, CISA states. Despite the use of security tools, poor user practices paved the way for successful attacks.

Attackers used a variety of techniques – phishing, brute force login attempts, and possibly a "pass the cookie" attack – to breach cloud services. CISA warns of phishing emails with links to harvest credentials for cloud service accounts. With these credentials, the attackers were able to log in and send emails from the target user's account to other accounts in the same business.

In several instances, they say, attackers collected sensitive data by abusing email forwarding rules that employees had set up to send business emails to their personal accounts. In one, they modified an email rule to redirect emails to an account controlled by the attackers. In some cases, attackers created new mailbox rules to forward specific emails with phishing-related keywords to the victim's RSS Feeds or Subscriptions folder so as to hide warnings.

These attackers successfully breached one user protected with multifactor authentication. They attempted brute force logins on some accounts, which were unsuccessful, officials say. In response to the attacks detailed in the alert, CISA has compiled an extensive list of steps that organizations can take to strengthen their cloud security practices.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3151
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...