Misconfiguration & Inadequate Change Control: Remove default credentials for each service and API you use. It’s easy for an attacker to discover your cloud services and try default login creds.
Lack of cloud security architecture & strategy: Threat model. A simple activity — document your assets, identify threats to those assets, and conceive of ways to thwart those threats. Disallow/deactivate services you don’t need.
Insufficient Identity, Access, Key Management: Don’t rely on username/password for authentication. RBAC, or a 2FA for login, can protect up to 80% of unauthorized access.
Account Hijacking: Alert on and monitor all new account creations. Hackers look for easy entry points. Once they gain access, they can escalate privileges for lateral movement.
Insider Threat: DLP (data loss prevention) can help flag exfiltration attempts.
Insecure Interfaces & APIs: Most frequent attack vector in 2022, according to Gartner. Force input validation for APIs you build; use CSP traffic throttling tools to prevent bot abuse/attacks.
Weak Control Plane: This is your command center. Treat it as such with strict and limited access control. Reduce the number of users who have access to the control plane and implement RBAC or MFA for a rigorous ID process.
Metastructure & Applistructure Failures: Monitor security bullets for 3rd-party applications/SaaS you use and act accordingly, e.g., patch. Conduct regular security assessments on your own applications and 3rd-party software (supply chain).
Limited Cloud Usage Visibility: Use an EASM (external attack surface monitoring) or CART (continuous automated red teaming) solution to scan for shadow IT regularly and other unsanctioned (yet live) assets.
Abuse and Nefarious Use of Cloud Services: Leverage CSPs monitoring services to identify abnormal resource/employee usage. This is always available yet seldom used. Related to this, maintain and enforce a list of approved apps and stores (allowed list).
I want to reiterate something that I started this document with: traditional cloud security issues, like network distributed denial of service (DDOS) attacks, are now mostly under control by the cloud service providers. As the CSPs have gotten much more mature and robust with security, those types of things don’t even make it onto the Egregious 11 list anymore.
The Egregious 11 is now much more elevated toward those business applications deployed on top of the metastructure – applications, services, and APIs. I view this as more of a permanent scenario given the lack of systemic knowledge organizations have related to secure cloud operations. Learn how to apply the tips above, most of which are long-standing security principles, to the environments and business applications you’re managing.
About Ed Adams, CEO
Ed Adams is a software quality and security expert with over 20 years of experience in the field. He served as a member of the Security Innovation Board of Directors since 2002 and as CEO since 2003. Ed has held senior management positions at Rational Software, Lionbridge, Ipswitch, and MathSoft. He was also an engineer for the US Army and Foster-Miller earlier in his career.
Ed is a Ponemon Institute Research Fellow, Privacy by Design Ambassador by the Information & Privacy Commissioner of Canada, Forbes Technology Council Member, and recipient of multiple SC Magazine’s Reboot Leadership Awards. He sits on the board of Cyversity, a non-profit committed to advancing minorities in the field of cyber security, and is a BoSTEM Advisory Committee member.
