{"id":50351,"date":"2023-02-01T13:00:00","date_gmt":"2023-02-01T13:00:00","guid":{"rendered":"https:\/\/www.csoonline.com\/article\/3686579\/misconfiguration-and-vulnerabilities-biggest-risks-in-cloud-security-report.html#tk.rss_security"},"modified":"2023-02-01T13:00:00","modified_gmt":"2023-02-01T13:00:00","slug":"misconfiguration-and-vulnerabilities-biggest-risks-in-cloud-security-report","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/misconfiguration-and-vulnerabilities-biggest-risks-in-cloud-security-report\/","title":{"rendered":"Misconfiguration and vulnerabilities biggest risks in cloud security: Report"},"content":{"rendered":"
<\/div>\n

The two biggest cloud security risks continue to be misconfigurations and vulnerabilities, which are being introduced in greater numbers through software supply chains, according to a report by Sysdig<\/a>. <\/p>\n

While zero trust<\/a> is a top priority, data showed that least privilege access rights, an underpinning of zero trust architecture, are not properly enforced. Almost 90% of granted permissions are not used, which leaves many opportunities for attackers who steal credentials, the report noted. <\/p>\n

The data was derived from an analysis of more than seven million containers that Sysdig customers are running daily. The report also considered data pulled from public data sources such as GitHub, Docker Hub, and the CNCF. Customer data across North and South America, Australia, the EU, UK, and Japan was analyzed for the report. <\/p>\n

87% of container images have high or critical vulnerabilities<\/strong> <\/h2>\n

Almost 87% of container images<\/a> were found to include a high or critical vulnerability, up from the 75% reported last year. Some images were found to have more than one vulnerability. Organizations are aware of the danger, but struggle with the tension of addressing vulnerabilities while maintaining the fast pace of software releases, Sysdig noted. <\/p>\n

The reason vulnerabilities persist despite having a fix is because of bandwidth and prioritization issues. When 87% of container images running in production have a critical or high severity vulnerability, a DevOps or security engineer can log in and see hundreds, if not thousands of images with vulnerabilities. <\/p>\n

\u201cIt takes time to go through the list and fix things. For most developers, writing code for new applications is what they are evaluated on, so every minute they spend on applying fixes is time not developing new applications that can be sold,\u201d Crystal Morin, threat research engineer at Sysdig said. <\/p>\n