Credit: Dreamstime
The two biggest cloud security risks continue to be misconfigurations and vulnerabilities, which are being introduced in greater numbers through software supply chains, according to a report by Sysdig.
While zero trust is a top priority, data showed that least privilege access rights, an underpinning of zero trust architecture, are not properly enforced. Almost 90 per cent of granted permissions are not used, which leaves many opportunities for attackers who steal credentials, the report noted.
The data was derived from an analysis of more than seven million containers that Sysdig customers are running daily. The report also considered data pulled from public data sources such as GitHub, Docker Hub, and the CNCF. Customer data across North and South America, Australia, the EU, UK, and Japan was analysed for the report.
87 per cent of container images have high or critical vulnerabilities
Almost 87 per cent of container images were found to include a high or critical vulnerability, up from the 75 per cent reported last year. Some images were found to have more than one vulnerability. Organisations are aware of the danger, but struggle with the tension of addressing vulnerabilities while maintaining the fast pace of software releases, Sysdig noted.
The reason vulnerabilities persist despite having a fix is because of bandwidth and prioritisation issues. When 87 per cent of container images running in production have a critical or high severity vulnerability, a DevOps or security engineer can log in and see hundreds, if not thousands of images with vulnerabilities.
“It takes time to go through the list and fix things. For most developers, writing code for new applications is what they are evaluated on, so every minute they spend on applying fixes is time not developing new applications that can be sold,” Crystal Morin, threat research engineer at Sysdig said.
Only 15 per cent of critical and high vulnerabilities with an available fix are in packages loaded at runtime. By filtering out those vulnerable packages that are actually in use, enterprises can focus their efforts on a smaller fraction of the fixable vulnerabilities that represent true risk.
Java packages are the riskiest
On measuring the percentage of vulnerabilities in packages loaded at runtime by package type to gauge which language, libraries, or file types presented the most vulnerability risk, Sysdig found that Java packages were responsible for 61 per cent of the more than 320,000 vulnerabilities in running packages. Java packages make up 24 per cent of the packages loaded at runtime.
More vulnerabilities in packages exposed at runtime results in a higher risk of compromise or attack. Java has the greatest number of vulnerabilities exposed at runtime. While Java is not the most popular package type across all container images, it is the most common in use at runtime.
“For this reason, we believe that both the good guys and the bad guys focus on Java packages to get the most bang for their buck. Due to its popularity, bug hunters are likely more dedicated to Java language vulnerabilities,” Morin said.
While newer or less common package types may seem more secure, Morin said this could be because vulnerabilities haven’t been discovered or worse yet, they have been found, but have not been disclosed.
Applying the shift-left, shield-right concept
Shift-left is the practice of moving testing, quality, and performance evaluation early in the development lifecycle. However, even with the perfect shift-left security practice, threats can arise in production.
Organisations should follow a shift-left and shield-right strategy, Sysdig suggested. Shield-right security emphasises mechanisms to protect and monitor running services.
“Traditional security practices with tools like firewalls and intrusion prevention systems (IPS) aren’t enough. They leave gaps because they typically don’t provide insight into containerised workloads and the surrounding cloud-native context,” Morin said.
Runtime visibility can help organisations to improve shift-left practice. Once containers are in production, a feedback loop to correlate issues discovered in runtime back to the underlying code helps developers know where to focus. Static security testing can also be informed by runtime intelligence to pinpoint what packages are executed inside the containers that run the application.
“This enables developers to deprioritise vulnerabilities for unused packages and focus instead on fixing exploitable, running vulnerabilities. The goal of every cybersecurity program should be full lifecycle security,” Morin added.
Misconfiguration biggest culprit in cloud security incidents
While vulnerabilities are a concern, misconfigurations are still the biggest player in cloud security incidents and, therefore, should be one of the greatest causes for concern in organisations. By 2023, 75 per cent of security failures will result from inadequate management of identities, access, and privileges, up from 50 per cent in 2020, according to Gartner.
Data from Sysdig showed that only 10 per cent of permissions granted to non-admin users were utilised when analysed over a 90-day window.
Sysdig’s year-over-year analysis revealed that organisations are either granting access to more employees or maturing their Identity and Access Management (IAM) practices. The growth in human user population may be a by-product of moving more business into cloud environments or ramping up staffing due to business growth, the cybersecurity firm noted.
This year, 58 per cent of identities on Sysdig customers’ cloud environment were found to be non-human roles, down from 88 per cent last year.
Non-human roles are often used temporarily and if they are no longer used and are not removed, they provide easy access points for malicious actors. “Reason for the shift in types of roles could be that organisations’ cloud use is growing and with the adoption, more employees are being granted cloud accesses, therefore shifting the balance of human and non-human roles,” Morin said.
More than 98 per cent of permissions granted to non-human identities have not been used for at least 90 days. “Oftentimes, these unused permissions are granted to orphaned identities, such as expired test accounts or third-party accounts,” Sysdig noted.
Applying least privilege principles to non-human identities
Security teams should apply least privilege principles to non-human identities in the same way they manage human identities. They should also remove unused test accounts wherever possible to prevent access risk. While this can be tedious to determine manually, in-use permission filters and automatically generated recommendations can make this process more efficient, Sysdig noted.
The least privilege principle is the same for non-humans as it is for humans. Organisations need to grant the minimum access that a human needs to do the job. The same applies to non-humans, such as applications, cloud services or commercial tools that need access to do their job.
These operate similar to how applications on cell phone that request permissions to access contacts, photos, camera, microphone, and more.
“With that, we must also consider access management for these non-human entities. Granting excessive permissions and not regularly managing granted permissions provides additional initial access, lateral movement, and privilege escalation options for malicious actors,” Morin said.
