Over 80 percent of companies have had cloud security incidents in the last year

According to a new report 81 percent of organizations have experienced a cloud-related security incident over the last 12 months, with almost half (45 percent) suffering at least four incidents.

The findings, from machine identity management specialist Venafi, reveal that the underlying issue for these security incidents is a dramatic increase in security and operational complexity connected with cloud deployments.

Organizations taking part in the study currently host 41 percent of their applications in the cloud but expect an increase to 57 percent over the next 18 months with a consequent increase in complexity likely.

Interestingly 51 percent of the security decision makers in the study believe that security risks are higher in the cloud than on premise, citing several issues. These include security incidents during runtime (34 percent), unauthorized access (33 percent), misconfigurations (32 percent) and major vulnerabilities that have not been remediated (24 percent).

Operational and security worries include: hijacking of accounts, services or traffic (35 percent), malware or ransomware (31 percent), privacy/data access issues, such as those from GDPR (31 percent), unauthorized access (28 percent) and nation state attacks (26 percent).

"Attackers are now on board with businesses shift to cloud computing," says Kevin Bocek, vice president of security strategy and threat intelligence at Venafi. "The ripest target of attack in the cloud is identity management, especially machine identities. Each of these cloud services, containers, Kubernetes clusters, and microservices needs an authenticated machine identity -- such as a TLS certificate -- to communicate securely. If any of these identities are compromised or misconfigured, it dramatically increases security and operational risks."

When asked who ought to be responsible for security cloud-based applications, the most popular option shares responsibility between cloud infrastructure operations teams and enterprise security teams (24 percent). The next most popular options are shared responsibility for multiple teams (22 percent), responsibility with developers writing cloud applications (16 percent) and DevSecOps teams (14 percent).

"Security teams want to collaborate and share responsibility with the developers who are cloud experts, but all too often they're left out of cloud security decisions," adds Bocek. "Developers are making cloud-native tooling and architecture decisions that decide approaches to security without involving security teams. And now we can see the results of that approach: security incidents in the cloud are rapidly growing. We need to reset the approach to cloud security and create consistent, observable, controllable security services across clouds and applications. Architecting in a control plane for machine identity is a perfect example of a new security model created specifically for cloud computing. This approach embeds security into developer processes and allows security teams to protect the business without slowing down engineers."

You can read more on the Venafi blog.

Image Credit: Maksim Kabakou/Shutterstock