Misconfiguration Remains the #1 Cause of Data Breaches in the Cloud

In a bid to stem the spread of COVID-19 and protect their business, companies are making a major shift to remote work. But their increased reliance on cloud applications is prompting deep concern among many IT and cloud professionals about the security of their environments.

According to a study by Fugue, 96% of cloud engineering teams are now 100% distributed and working from home in response to the novel Coronavirus crisis. 83% have completed the transition or are doing so. Of those making the shift, 84% are concerned about security vulnerabilities caused by new access policies, networks, and devices used for managing cloud infrastructure remotely.

Because cloud misconfiguration exploits can be difficult to detect using traditional security solutions, the vast majority of IT professionals fear that their organization has already suffered a major cloud breach that they have yet to discover. And 28% admit they've already suffered such a critical breach.

92% worry that their organization is vulnerable to a major cloud misconfiguration-related data breach. A third of respondents believe cloud misconfigurations will increase over the next year.

But what exactly are the top causes of cloud misconfiguration? Respondents cited a lack of awareness of cloud security and policies (52%), a lack of adequate controls and oversight (49%), too many cloud APIs and interfaces to adequately govern (43%), and negligent insider behavior (32%).

Three quarters of IT pros still rely on manual processes to defend against automated misconfiguration threats. Reliance on manual approaches to managing cloud misconfiguration, however, creates new problems, including human error in missing or mis-categorizing critical misconfigurations (46%) and when remediating them (45%). Almost half of those surveyed cite difficulties in training team members to identify and remediate misconfiguration, and 39% face challenges in hiring enough cloud security experts. Issues such as false positives and alert fatigue were also listed as problems teams have encountered.

“With cloud misconfiguration rates at such high levels and a widespread reliance on manual processes to manage it, the costs are predictably high for cloud customers. 49% of cloud engineering and security teams are devoting more than 50 man hours per week managing cloud misconfiguration, with 20% investing more than 100 hours on the problem,” Fugue researchers said.

Asked what they’d need to manage cloud misconfigurations more effectively and efficiently, 95% of IT pros cited tooling to automatically detect and remediate misconfiguration events. And roughly a third cited the need for better visibility into cloud infrastructure and timely notifications of dangerous changes.

As legacy security tools are ill-prepared to protect cloud environments, Bitdefender GravityZone was designed specifically to cater to virtualized and cloud workloads by combining next-generation capabilities like automated patch management, application control, memory protection, exploit prevention, behavioral monitoring, tunable machine learning, network sandboxing and Endpoint Detection and Response (EDR), all into one centrally managed solution covering all physical, virtual and cloud endpoints in the enterprise.