The treachery and evolution of the cyber threat landscape is well known at this point, as is the importance of awareness of problems as a precursor to addressing them. With cloud computing and storage growing in users across the globe, maintaining awareness of the gravity and scope of the latest threats facing the cloud is important. What follows will take a look at the latest data on the cloud landscape, including brief case studies.
According to the 2024 Cloud Security Study published by @Thales, four of the top five most highly targeted vectors for cyberattacks are cloud-based, focusing on applications, storage, and management infrastructure1. This data indicates that the cloud has overtaken on-premises and locally hosted targets. While not entirely surprising given rapid technological advancements and adoption, this inevitable arrival highlights the urgent need for organizations to ensure a robust cloud-focused defense strategy in part of any cyber resilience program.
To further illustrate the complex challenges cloud-dependent organizations face in maintaining data integrity, research from @IBM indicates 40% of all breaches captured data stored either solely in either a public or private cloud and another 40% captured data that was stored in both cloud and on-premises locations2. As companies adopt more cloud-hosted and cloud-delivered technologies—around 60% of large organizations utilize “more than 25 SaaS [Software as a Service] applications and 30% have more than 50”—maintaining appropriate security regarding every single one of these applications is immensely challenging1.
As threat actors focus their attacks on cloud environments, it should be unsurprising to learn that close to 50% of businesses, per the Thales study, experienced a breach in their cloud environment. Many of these originate through these third-party applications. While not all breaches necessarily result in lost data or organizational downtime, the rate is yet another concerning statistic pointing to the profound challenge of securing sensitive data. Continued data migration and cloud usage will likely exacerbate these risks.
Case Studies
To more fully capture the nature and challenges of cloud cybersecurity, what follows are several actual case studies demonstrating the numerous ways in which threat actors access targeted networks.
Healthcare: False Invoice
Victim: Government Health Insurance Program3
How it happened: The victim entities were scammed into wiring payments in a series of schemes involving several threat actors operating out of different states. In most cases, threat actors created email accounts that looked nearly identical to legitimate businesses and hospitals. Targets were tricked via social engineering schemes into updating the bank account details for reimbursement payments. To cover their tracks, the threat actors used stolen identities to open bank accounts in the name of shell companies.
~~~~~~~~~
Construction: Unauthorized Access & Lateral Movement
Victim: Construction Risk Management Firm4
How it happened: The victim organization first reported that suspicious activity was identified on their network, though there has been no definitive indicator as to how the initial breach occurred. Once in the network, the threat actor was able to access sensitive information related to more than 60,000 customers as well as current and former employees. Because the organization did not have robust network visibility and lacked proper access controls, threat actors were able copy and exfiltrate highly sensitive data after escalating their privileges and moving with relative freedom throughout the network.
~~~~~~~~
Education: Leaked Credentials
Victim: Large Urban School District5
How it happened: A Russian-based threat group, Vice Society, utilized the legitimate credentials of a school employee to access the broader district network. These credentials were available on the dark web following a prior cyberattack. The employee, in this case, had wide access, including the ability to login through the district’s VPN (virtual private network). As this attack occurred over the Labor Day weekend when internal teams were off duty, the threat actors were able to move extensively and unobserved throughout the environment. In the end, 500 GB of data was exfiltrated, including sensitive student information. The breach cost taxpayers approximately $18M to remediate.
Education: Social Engineering & Account Compromise
Victim: Public School District6
How it happened: A large school district lost more than $6 million after threat actors appeared to have gained access to the email account of the district’s chief operating officer (COO). The threat actors monitored the private email correspondence between the COO and a district vendor. Eventually, the threat actors impersonated both organizational leaders in order to divert district payments to its school bus contractor and a law firm to fraudulent accounts. So far, $3.6 million has been recouped.
~~~~~~~~
Government/Municipalities: Third-Party Data Breach
Victim: Department of Insurance, Securities and Banking (DISB)7
How it happened: The data breach at the Washington D.C. DISB originated with an attack on a third-party technology provider. The LockBit ransomware gang accessed and stole 800GB of data stored on the third-party vendor’s cloud, which contained sensitive client data. The technology provider discovered unauthorized activity in their private cloud hosting environment, leading to the breach. Following an investigation into the incident, it was determined that threat actors gained legitimate credentials via a brute force attack, which were subsequently used to takeover user accounts. Despite taking the system offline and launching an investigation, some of the stolen data was publicly exposed.
Factors Contributing to Data Breach Cost and Mitigation
While there is no singular or absolute way to avoid being a victim, there are various factors that contribute to raising or lowering the cost and difficulty of responding to a cloud-centered breach. One way to enhance your ability to identify and counter threats against your cloud environment is to limit, as much as is possible, the various factors that make them prime targets. The 2024 IBM Cost of a Data Breach Report identified several of these factors. Here are the top five, in order of additional cost:
Complicating Factors:
Mitigating Factors
In conjunction with these compounding factors are those that “reduced the average breach cost” per the @IBM report. Again, the top five:
This is not to say that improving upon these 10 areas will guarantee your company operations free from cyberattacks or other security incidents. What it does mean, however, is that your organization will be better positioned to learn from those who have experienced significant breaches and operational downtime and implement a robust security program to defend against predatory threat actors.
If you want to learn more about how we help organizations prevent these targeted attacks, navigate here: https://www.speartip.com/shadowspear-cloud-monitoring/
Sources
Identify, neutralize, and counter cyberattacks - provide confidence in your security posture
©2024 SpearTip, LLC. All rights reserved.