Tenable report sounds alarm over toxic cloud exposures

Tenable, the exposure management company, has released its 2024 Tenable Cloud Risk Report, which examines the critical risks at play in modern cloud environments. Most alarmingly, nearly four in 10 organisations globally are leaving themselves exposed at the highest levels due to the “toxic cloud trilogy” of publicly exposed, critically vulnerable and highly privileged cloud workloads. Each of these misalignments alone introduces risk to cloud data, but the combination of all three drastically elevates the likelihood of exposure access by cyberattackers.

Security gaps caused by misconfigurations, risky entitlements and vulnerabilities combine to dramatically increase cloud risk. The Tenable Cloud Risk Report provides a deep dive into the most pressing cloud security issues observed in the first half of 2024, highlighting areas such as identities and permissions, workloads, storage resources, vulnerabilities, containers, and Kubernetes. It also offers mitigation guidance for organisations seeking ways to limit exposures in the cloud.

Security gaps caused by misconfigurations, risky entitlements and vulnerabilities dramatically increase cloud risk

Publicly exposed and highly privileged cloud data leads to data leaks. Critical vulnerabilities exacerbate the likelihood of incidents. The report reveals that a staggering 38% of organisations have cloud workloads that meet all three of these toxic cloud trilogy criteria, representing a perfect storm of exposure for cyberattackers to target.

When bad actors exploit these exposures, incidents commonly include application disruptions, full system takeovers and DDoS attacks that are often associated with ransomware. Scenarios like these could devastate an organisation, with the 2024 average cost of a single data breach approaching US$5-million (source: IBM Security Cost of a Data Breach Report 2024).

Additional key findings from the report include:

Eight-four percent of organisations have risky access keys to cloud resources: The majority of organisations (84.2%) possess unused or longstanding access keys with critical or high severity excessive permissions, a significant security gap that poses substantial risk.
Twenty-three percent of cloud identities have critical or high severity excessive permissions: Analysis of Amazon Web Services, Google Cloud Platform and Microsoft Azure reveals that 23% of cloud identities, both human and non-human, have critical or high severity excessive permissions.
Critical vulnerabilities persist: Notably, CVE-2024-21626, a severe container escape vulnerability that could lead to the server host compromise, remained unremediated in over 80% of workloads even 40 days after its publishing.
Seventy-four percent of organisations have publicly exposed storage: Some 74% of organisations have publicly exposed storage assets, including those in which sensitive data resides. This exposure, often due to unnecessary or excessive permissions, has been linked to increased ransomware attacks.
Seventy-eight percent of organisations have publicly accessible Kubernetes API servers: Of these, 41% also allow inbound internet access. Additionally, 58% of organisations have cluster-admin role bindings, which means that certain users have unrestricted control over all the Kubernetes environments.

“Our report reveals that an overwhelming number of organisations have access exposures in their cloud workloads of which they may not even be aware,” said Shai Morag, chief product officer at Tenable. “It’s not always about bad actors launching novel attacks. In many instances, misconfigurations and over-privileged access represent the highest risk for cloud data exposures. The good news is, many of these security gaps can be closed easily once they are known and exposed.”

The report reflects findings by the Tenable Cloud Research team based on telemetry from billions of cloud resources across multiple public cloud repositories, analysed from 1 January to 30 June 2024.

To download the report today, visit www.tenable.com/cyber-exposure/tenable-cloud-risk-report-2024.

About Tenable
Tenable is the exposure management company, exposing and closing the cybersecurity gaps that erode business value, reputation and trust. The company’s AI-powered exposure management platform radically unifies security visibility, insight and action across the attack surface, equipping modern organisations to protect against attacks from IT infrastructure to cloud environments to critical infrastructure and everywhere in between. By protecting enterprises from security exposure, Tenable reduces business risk for more than 44 000 customers around the globe. Learn more at tenable.com.