Please enter your contact information to view the complete report:

Cloud Computing Top Threats in 2016

CSA Top Threats Working Group
The Treacherous 12

Executive Summary

At an unprecedented pace, cloud computing has simultaneously transformed business and government, and created new security challenges. The development of the cloud service model delivers business-supporting technology more efficiently than ever before. The shift from server to service-based thinking is transforming the way technology departments think about, design, and deliver computing technology and applications. Yet these advances have created new security vulnerabilities as well as amplify existing vulnerabilities, including security issues whose full impact are finally being understood. Among the most significant security risks associated with cloud computing is the tendency to bypass information technology (IT) departments and information officers. Although shifting to cloud technologies exclusively may provide cost and efficiency gains, doing so requires that business-level security policies, processes, and best practices are taken into account. In the absence of these standards, businesses are vulnerable to security breaches that can erase any gains made by the switch to cloud technology.

Seeing both the promise of cloud computing, and the risks associated with it, the Cloud Security Alliance (CSA) has created industry-wide standards for cloud security. In recent years, CSA released the “Security Guidance for Critical Areas in Cloud Computing” and the “Security as a Service Implementation Guidance”. These documents have quickly become the industry-standard catalogue of best practices to secure cloud computing, comprehensively addressing this within the thirteen domains of CSA Guidance and ten categories of service associated with the Security as a Service (SecaaS) Implementation Guidance series. Many businesses, organizations, and governments have incorporated this guidance into their cloud strategies.

Similar to the earlier mentioned research artifacts, the “The Treacherous 12 - Cloud Computing Top Threats in 2016” play a crucial role in the CSA research ecosystem. The purpose of the report is to provide organizations with an up-to-date, expert-informed understanding of cloud security concerns in order to make educated riskmanagement decisions regarding cloud adoption strategies. The report reflects the current consensus among security experts in CSA community about the most significant security issues in the cloud.

While there are many security concerns in the cloud, this report focuses on 12 specifically related to the shared, on-demand nature of cloud computing. To identify the top concerns, CSA conducted a survey of industry experts to compile professional opinions on the greatest security issues within cloud computing. The Top Threats working group used these survey results alongside their expertise to craft the final 2016 report. In this most recent edition of the report, experts identified the following 12 critical issues to cloud security (ranked in order of severity per survey results):

  1. Data Breaches
  2. Weak Identity, Credential and Access Management
  3. Insecure APIs
  4. System and Application Vulnerabilities
  5. Account Hijacking
  6. Malicious Insiders
  7. Advanced Persistent Threats (APTs)
  8. Data Loss
  9. Insufficient Due Diligence
  10. Abuse and Nefarious Use of Cloud Services
  11. Denial of Service
  12. Shared Technology Issues

The 2016 Top Threats release mirrors the shifting ramifications of poor cloud computing decisions up through the managerial ranks, instead of being an IT issue it is now a boardroom issue. The reasons may lie with the maturation of cloud, but more importantly, higher strategic decisions by executives in cloud adoption. The 2013 edition highlighted developers and IT departments rolling out their own self-service Shadow IT projects, and the bypassing of organizational security requirements. In 2016, cloud adoption may be effectively aligned with the executive strategies to maximize shareholder value. The always-on nature of Cloud Computing impacts factors that may skew external perceptions and in turn company valuations. Wider reaching architecture/design factors of Identity, Credential and Access Management, Insecure APIs and System & Application Vulnerabilities rise in the survey, while data loss and individual account hijacking fell in comparison.

With descriptions and analysis of the Treacherous 12, this report serves as an up-to-date guide that will help cloud users and providers make informed decisions about risk mitigation within a cloud strategy. This threat research document should be utilized in conjunction with the best practices guides, “Security Guidance for Critical Areas in Cloud Computing V.3” and “Security as a Service Implementation Guidance”. A threat analysis was also conducted with the STRIDE Threat Model[1] and the working group recommends the NIST Risk Management Framework[2] on guidance for how to manage information technology risk. Together, these documents will offer valuable guidance during the formation of comprehensive, appropriate cloud security strategies.

Follow us on social, blogs, and emails: Facebook linkTwitter linkRSS linkRSS link

To view PDF files, download the latest version of Acrobat.