Eleven top threats to cloud computing appear in the 2024 report of the Cloud Security Alliance. Misconfiguration and weak identity and access management lead the list. Insecure interfaces, third party resources and poor visibility follow close behind. Data and identities belong to you in every cloud model so these threats remain your concern.
Your company moves files and apps to the cloud and a new question appears. Who protects them and what can go wrong?
This guide lists the threats that the Cloud Security Alliance names and explains the duties that remain yours.
Who is Responsible for Cloud Security?
Microsoft states that you retain ownership of your data and identities in every cloud deployment type. Provider duties grow as you move from infrastructure to software services. See shared responsibility in the cloud.
Microsoft also states that this guidance is illustrative and that your contract with the provider sets the legal terms.
What are the Top Security Issues in Cloud Computing?
Cloud Security Alliance (CSA) names eleven top threats in its 2024 report. See Top Threats to Cloud Computing 2024.
| Threat | Plain Meaning |
|---|---|
| 1. Misconfiguration and inadequate change control | Settings are wrong or change without review |
| 2. Identity and access management | Weak control over who reaches which resource |
| 3. Insecure interfaces and APIs | Exposed or weak access points to services |
| 4. Inadequate cloud security strategy | The security approach is poorly chosen or applied |
| 5. Insecure third party resources | Weak outside vendors or components |
| 6. Insecure software development | Flaws built into applications |
| 7. Accidental cloud disclosure | Sensitive data is exposed by mistake |
| 8. System vulnerabilities | Unpatched or exploitable weaknesses |
| 9. Limited cloud visibility | Too little insight into cloud activity |
| 10. Unauthenticated resource sharing | Resources are shared without checking who asks |
| 11. Advanced persistent threats | Sophisticated long term attacks |
CSA lists the names only. My short summaries fill the second column.
Which Threats should You Address First?
CSA lists misconfiguration and identity at the top. Start with those two because they depend on your own settings and accounts.
- Review cloud settings against a written standard.
- Record every edit to settings.
- Limit access to the minimum that a role needs.
- Enable multifactor authentication on all admin accounts.
- Review who can reach public links and shared folders.
How do You Improve Cloud Visibility?
List every cloud service your company uses. Enable activity logs for every service and review alerts on a schedule.
For protective controls see data protection controls for business cloud data. For the benefit side see the benefits of cloud computing.
Frequently Asked Questions
What are the Biggest Security Issues in Cloud Computing?
CSA lists misconfiguration first and identity and access management second in its 2024 report.
How Many Top Threats does CSA List?
Eleven in the 2024 report.
Who Owns Data Security in the Cloud?
You own both. Microsoft states that the customer owns data and identities in every cloud model.
Is the Cloud Less Safe Than on Premises?
No source in this guide says so. Threats depend on your settings, accounts and software, and the provider shares part of the duty.
How do I Reduce Misconfiguration Risk?
Review settings against a written standard and record every edit.
Key Takeaways
- CSA names eleven top cloud threats for 2024.
- Misconfiguration and identity and access management lead the list.
- Customers own data and identities in every cloud model.
- Written standards and edit records reduce misconfiguration.
- Visibility needs logs and alerts for every cloud service.
Sources and References
This guide follows Cloud Security Alliance and Microsoft documentation.
- Top Threats to Cloud Computing 2024 (Cloud Security Alliance) cloudsecurityalliance.org
- Shared Responsibility in the Cloud (Microsoft Learn) learn.microsoft.com