Businesses Struggle with Cloud Availability as Attackers Take Aim

The majority of organizations have separate tools for networking and security, researchers report in a new survey on cloud and networking challenges. Their findings emerge as US government officials warn businesses of successful attacks on corporate cloud services. 

Barracuda Networks today published a survey conducted by Censuswide, which polled more than 800 IT decision makers responsible for cloud infrastructure. The majority – 69% in the US and 56% overall – struggle to ensure availability and always-on access to cloud applications for employees. Most of the businesses say they're challenged with latency, downtime, and cost.

"The Internet is the core utility for us to get our day-to-day work done," says Sinan Eren, vice president of zero-trust access at Barracuda. "It's tougher for organizations to leverage the public Internet and grow their base of employees accessing these solutions on a daily basis."

Nearly 70% experience latency and performance issues running software-as-a-service (SaaS) workloads such as Office 365, researchers report, a trend they anticipate will continue. As businesses grow more dependent on the cloud, they encounter a number of constraints. Downtime is a constant issue; lack of bandwidth is a common complaint. Organizations using a traditional network that backhauls traffic through a centralized data center find users and networks suffer from latency.

The cost of network infrastructure has proved a hurdle for businesses working to fix the problem. More than 70% use traditional access methods, such as multiprotocol label switching (MPLS) in their networks. At least 60% say their MPLS costs significantly increase with seasonal workload peaks, while a similar number say they think MPLS lines are pricey and inflexible for their business needs. 

"It does take a tremendous amount of investment to improve these workloads and improve the efficiency, performance, and latency," Eren says. 

Most companies have historically used dedicated lease lines, such as MPLS lines, to interconnect network infrastructure, researchers note. These leases are typically long-term and don't scale up or down, often resulting in a mismatch in capacity. Organizations often find they're paying more than they should for capacity they may not necessarily need all the time. 

Of the businesses surveyed, 86% have separate products that specifically focus on networking or security. Around the same amount believe security should be incorporated throughout the network, not only applied at the data center, and 70% say security is a primary concern for the organization when deploying an SD-WAN tool.

Dark Clouds Ahead
The cloud-related challenges companies face set a concerning stage for an alert published this week by the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA). US officials warn of "several recent successful cyberattacks against various organizations' cloud services," done by attackers exploiting poor cyber hygiene practices within a victim's cloud services configuration. 

These attacks frequently occurred when a target organization's employees worked remotely and used a combination of corporate and personal devices to access cloud services, CISA states. Despite the use of security tools, poor user practices paved the way for successful attacks.

Attackers used a variety of techniques – phishing, brute force login attempts, and possibly a "pass the cookie" attack – to breach cloud services. CISA warns of phishing emails with links to harvest credentials for cloud service accounts. With these credentials, the attackers were able to log in and send emails from the target user's account to other accounts in the same business.

In several instances, they say, attackers collected sensitive data by abusing email forwarding rules that employees had set up to send business emails to their personal accounts. In one, they modified an email rule to redirect emails to an account controlled by the attackers. In some cases, attackers created new mailbox rules to forward specific emails with phishing-related keywords to the victim's RSS Feeds or Subscriptions folder so as to hide warnings.

These attackers successfully breached one user protected with multifactor authentication. They attempted brute force logins on some accounts, which were unsuccessful, officials say. In response to the attacks detailed in the alert, CISA has compiled an extensive list of steps that organizations can take to strengthen their cloud security practices.