Fast Facts

• Nearly 80% of organizations experienced a cloud or on-premises breach in the past year.
• Vulnerability exploitation (24%) and compromised credentials (20%) are top cloud breach causes.
• Misconfigurations account for 16% of cloud security incidents - often simple human mistakes.
• Attackers are increasingly bypassing security by stealing login details and abusing legitimate tools.
• Cloud adoption is nearly universal, but security concerns remain the leading barrier for businesses.

Welcome to the Cloud - Now, Mind the Traps

Picture the cloud as a gleaming skyscraper: glassy, modern, and full of promise. But behind its shining façade, the wrong key left in the door or a forgotten window latch can turn that promise into a disaster. According to a new AWS report, it’s not just sophisticated hackers or cutting-edge malware that businesses need to fear - it’s their own passwords, missteps, and oversights.

The Real Culprits: Credentials and Configuration

AWS’s “Building Cloud Trust” report, surveying 2,800 tech and security leaders worldwide, uncovers a paradox: as nearly all organizations rush to the cloud, most breaches still trace back to basic human errors. Vulnerability exploitation and compromised credentials - think stolen passwords or reused logins - are the most common entry points for attackers, while misconfiguration (settings left open or incorrect) remains a persistent threat. These aren't exotic cyber weapons; they're the digital equivalent of leaving the front door ajar.

Despite the cloud’s reputation for ironclad security, about 79% of organizations reported a breach last year - almost identical to on-premises systems. The causes are often mundane: overwhelmed IT teams, complex systems, or simple lapses in vigilance. Physical theft, surprisingly, still factors in, but it’s the digital keys that criminals covet most.

Attackers Evolve - So Must Defenders

Cybercriminals are growing more cunning. The Darktrace 2024 Threat Report details how hackers now favor “living off the land” - using legitimate software and tools to hide in plain sight. Phishing tactics, such as Adversary-in-the-Middle (AiTM) attacks, enable them to sidestep even multi-factor authentication (MFA). Once inside, they quietly steal data, extort companies, or conduct espionage.

Recent breaches, like those exploiting vulnerabilities in widely used perimeter devices (Ivanti, Fortinet, Palo Alto Networks), show attackers targeting weak links outside the core cloud infrastructure. As defenders close off human login weaknesses with MFA, criminals are shifting to target “non-human identities” - automated accounts or machine credentials that often lack strong protection.

Cloud Confidence: Built on More Than Tech

Cloud’s promise is agility and innovation, but its reality is a shared responsibility: strong providers and vigilant customers. AWS’s findings echo lessons from past high-profile incidents like the Capital One breach (2019), where a misconfigured firewall led to the theft of over 100 million records. The message is clear: in the cloud, small mistakes have outsized consequences.

Regulators and insurers are watching. As governments push for stricter cloud security standards, and insurance premiums reflect rising breach costs, the market is demanding transparency and accountability. For organizations, success means investing in training, reviewing configurations, and never underestimating the simplest errors.

WIKICROOK

• Misconfiguration: Misconfiguration is a setup error in systems or software that leaves them vulnerable to cyberattacks, like accidentally leaving a door unlocked.
• Compromised Credentials: Compromised credentials are stolen or leaked usernames and passwords that let attackers gain unauthorized access to systems or accounts.
• Multi: Multi refers to using a combination of different technologies or systems - like LEO and GEO satellites - to improve reliability, coverage, and security.
• Living: Living off the Land means attackers use trusted system tools (LOLBins) for malicious actions, making their activities stealthy and hard to detect.
• Adversary: An adversary is any person or group attempting to breach computer systems or data, often for malicious purposes like theft or disruption.