2.3 Cloud specific Vulnerabilities.

Question 1

Security in the cloud

Answer 1

Cloud adoption has been nearly universal; It’s difficult to find a company not using the cloud.

Weve put sensitive data in the cloud. Attackers would like this data.

We are not putting in the right protections. 76% of organizations aren’t using MFA for management console users.

Simple best practice aren’t being used. 63% of code in production is unpatched. Vulnerabilities rated high or critical (CVSS>= 7.0).

Question 2

Attack the device

Answer 2

Denial of service (DoS). A fundamental attack type.

Authentication bypass. Take advantage of weak or faulty authentication.

Directory traversal. Faulty configurations put data at risk.

Remote code execution. Take advantage of unpatched systems.

Question 3

Attack the application

Answer 3

Web application attacks have increased. Log4j and spring cloud function. Easy to exploit, rewards are extensive.

Cross site scripting (XSS). Take advantage of poor input validation.

Out of bounds write. Write to unauthorized memory areas. Data corruption, crashing, or code execution.

SQL injection. Get direct access to a database.