[ad_1]
Attackers centered on the cloud are utilizing extra refined techniques to goal at Kubernetes and the software program provide chain, says Aqua Safety.
As extra organizations shift to the cloud to handle their operations and property, so too have cybercriminals been shifting their focus to cloud environments. To up their sport, attackers are adopting extra superior and complicated strategies to focus on delicate and weak cloud native environments. A report launched Wednesday by safety agency Aqua Safety seems on the assault vectors focusing on Kubernetes in addition to the provision chain and gives recommendation on defending your cloud environments.
SEE: Eight enterprise password managers and the businesses that can love them (TechRepublic)
For its report “Monitoring Software program Provide Chain and Kubernetes Assaults,” researchers at Aqua’s Crew Nautilus arrange honeypots to draw attackers and trick them into creating malicious recordsdata, cryptominer exercise, code injection and different malicious content material. Such honeypots are managed by safety researchers expressly to watch malicious conduct and collect intel on adversaries.
Aqua discovered that cybercriminals are utilizing new techniques, strategies and procedures to focus on cloud-based environments. Cryptominers had been the commonest kind of malware found, however attackers are additionally more and more turning to backdoors, rootkits and credential stealers.
Backdoors, which permit attackers to realize distant entry to a compromised system, had been seen in 54% of the assaults in 2021, up by 9% from 2020. The usage of worms that replicate and unfold all through a system accounted for 51% of all of the assaults final 12 months, a acquire of 10% from 2020.
Criminals have additionally shifted their focus from Docker to Kubernetes. Assaults in opposition to weak Kubernetes deployments and purposes elevated to 19% in 2021, up from 9% in 2020. Kubernetes environments are a tempting goal, as as soon as an attacker positive factors preliminary entry, they will simply transfer laterally to develop their presence.
Assaults that have an effect on a complete provide chain have elevated over the previous few years, and that has been felt throughout the software program provide chain as effectively. In 2021, attackers aiming at software program suppliers in addition to their clients and companions employed a wide range of techniques, together with exploiting open supply vulnerabilities, infecting well-liked open supply packages, compromising CI/CD instruments and code integrity, and manipulating the construct course of. Final 12 months, supply-chain assaults accounted for 14.3% of the samples seen from public picture libraries.
“These findings underscore the truth that cloud native environments now symbolize a goal for attackers, and that the strategies are all the time evolving,” mentioned Assaf Morag, menace intelligence and information analyst lead for Aqua’s Crew Nautilus. “The broad assault floor of a Kubernetes cluster is enticing for menace actors, after which as soon as they’re in, they’re in search of low-hanging fruit.”
To assist organizations extra successfully defend their cloud-native environments, Aqua gives a couple of suggestions:
Implement runtime safety. Runtime safety is a key issue for any cloud-based safety technique. That is particularly necessary to defend in opposition to supply-chain assaults that may introduce vulnerabilities that will solely be exploited throughout runtime.
Layer your Kubernetes safety. As attackers exploit Kubernetes UI instruments and goal particular Kubernetes parts equivalent to kubelets and API servers, you have to safe your Kubernetes environments on the container and orchestrator degree. Such a layered technique is essential to combating any assault launched in opposition to a Kubernetes ecosystem.
Activate scanning throughout growth. Vulnerabilities equivalent to Log4j are proof that safety scanning should be carried out in the course of the growth cycle. As such, you want instruments that provide visibility into your complete cloud native stack.
“The important thing takeaway from this report is that attackers are extremely energetic — greater than ever earlier than — and extra incessantly focusing on vulnerabilities in purposes, open supply and cloud know-how,” mentioned Morag. “Safety practitioners, builders and devops groups should search out safety options which can be purpose-built for cloud native. Implementing proactive and preventative safety measures will permit for stronger safety and finally defend environments.”
[ad_2]
