![](https://blog.trendmicro.com/wp-content/uploads/2020/04/cloud4-300x300.jpg) _This overview builds on the recent report from Trend Micro Research on cloud-specific security gaps, which can be found [here.]()_ Don’t be cloud-weary. Hear us out. Recently, a major tipping point was reached in the IT world when more than half of new IT spending was on cloud over non- cloud. So rather than being the exception, cloud-based operations have become the rule. However, too many security solutions and vendors still treat the cloud like an exception – or at least not as a primary use case. The approach remains “and cloud” rather than “cloud and.” Attackers have made this transition. Criminals know that business security is generally behind the curve with its approach to the cloud and take advantage of the lack of security experience surrounding new cloud environments. This leads to ransomware, cryptocurrency mining and data exfiltration attacks targeting cloud environments, to name a few. **Why Cloud?** There are many reasons why companies [transition to the cloud](). Lower costs, improved efficiencies and faster time to market are some of the primary benefits touted by cloud providers. These benefits come with common misconceptions. While efficiency and time to market can be greatly improved by transitioning to the cloud, this is not done overnight. It can take years to move complete data centers and operational applications to the cloud. The benefits won’t be fully realized till the majority of functional data has been transitioned. **Misconfiguration at the User Level is the Biggest Security Risk in the Cloud** Cloud providers have built in security measures that leave many system administrators, IT directors and CTOs feeling content with the security of their data. We’ve heard it many times – “My cloud provider takes care of security, why would I need to do anything additional?” This way of thinking ignores the shared responsibility model for security in the cloud. While cloud providers secure the platform as a whole, companies are responsible for the security of their data hosted in those platforms. Misunderstanding the shared responsibility model leads to the No. 1 security risk associated with the cloud: **Misconfiguration**. You may be thinking, “But what about ransomware and cryptomining and exploits?” Other attack types are primarily possible when one of the 3 misconfigurations below are present. You can forget about all the worst-case, overly complex attacks: Misconfigurations are the greatest risk and should be the No. 1 concern. These misconfigurations are in 3 categories: | 1. Misconfiguration of the native cloud environment 2. Not securing equally across multi-cloud environments (i.e. different brands of cloud service providers) 3. Not securing equally to your on-premises (non-cloud) data centers ---|--- | **How Big is The Misconfiguration Problem?** Trend Micro Cloud One![™](https://s.w.org/images/core/emoji/12.0.0-1/72x72/2122.png) – Conformity identifies an average of [**230 million misconfigurations**]() per day. To further understand the state of cloud misconfigurations, Trend Micro Research [recently investigated]() cloud-specific cyber attacks. The report found a large number of websites partially hosted in world-writable cloud-based storage systems. Despite these environments being secure by default, settings can be manually changed to allow more access than actually needed. These misconfigurations are typically put in place without knowing the potential consequences. But once in place, it is simple to scan the internet to find this type of misconfiguration, and criminals are exploiting them for profit. **Why Do Misconfigurations Happen?** The risk of misconfigurations may seem obvious in theory, but in practice, overloaded IT teams are often simply trying to streamline workflows to make internal processes easier. So, settings are changed to give read and/or write access to anyone in the organization with the necessary credentials. What is not realized is that this level of exposure can be found and exploited by criminals. We expect **this trend will increase in 2020**, as more cloud-based services and applications gain popularity with companies using a DevOps workflow. Teams are likely to misconfigure more cloud-based applications, unintentionally exposing corporate data to the internet – and to criminals. _Our prediction is that through 2025, more than 75% of successful attacks on cloud environments will be caused by missing or misconfigured security by cloud customers rather than cloud providers._ **How to Protect Against Misconfiguration** Nearly all data breaches involving cloud services have been [caused by misconfigurations](). This is easily preventable with some basic cyber hygiene and regular monitoring of your configurations. Your data and applications in the cloud are only as secure as you make them. There are enough tools available today to make your cloud environment – and the majority of your IT spend – at least as secure as your non-cloud legacy systems. You can secure your cloud data and applications today, especially knowing that attackers are already cloud-aware and delivering vulnerabilities as a service. Here are a few best practices for securing your cloud environment: | * Employ the principle of least privilege: Access is only given to users who need it, rather than leaving permissions open to anyone. * Understand your part of the [Shared Responsibility Model](): While cloud service providers have built in security, the companies using their services are responsible for securing their data. * Monitor your cloud infrastructure for [misconfigured and exposed systems](): Tools are available to identify misconfigurations and exposures in your cloud environments. * Educate your [DevOps teams]() about security: Security should be built in to the DevOps process. ---|--- | To read the complete Trend Micro Research report, please visit: . For additional information on Trend Micro’s approach to cloud security, click here: . The post [Cloud Transformation Is The Biggest Opportunity To Fix Security]() appeared first on []().

Query Builder