Orca Security identified the five most common and severe cloud security risks for this year so far based its research, including patching, data storing and identity and management (IAM) issues.

The Orca Research Pod, a group of cloud security researchers from the company, analyzed workload, configuration and identity data captured from billions of real-world production cloud assets on Amazon Web Services (AWS), Microsoft Azure, Google Cloud, Kubernetes, and serverless functions that were scanned by the Orca Cloud Security Platform from January 1 to May 1, 2023.

They found the top 5 cloud security issues are “not the newest and most talked about” ones, but are part of cybersecurity fundamentals and best practices — such as the need to patch vulnerable web services and enforce policies that adhere to the concept of zero trust. This “further highlights what is commonly said in the industry: that we should first focus on the security basics to make the largest improvement in cloud security postures,” researchers noted in the report.

Top 5 cloud security risks

Here are the top cloud security risks that Orca researchers identified:

1. Unpatched exposed web services

The report showed 36% of organizations have at least one unpatched, internet-exposed web service in their cloud environment. Researchers warned unpatched services with known vulnerabilities are one of the main attack vectors in cloud environments.

2. Sensitive information in Git repositories

Orca found around half of the analyzed organizations have at least one Git repository containing sensitive data, such as database passwords, API keys, encryption keys, hash salts and secrets. If that information is part of organizations’ source code, attackers can potentially extract them and compromise the systems.

3. Storing sensitive AWS keys on file systems

About 49% of analyzed organizations have sensitive AWS keys stored on a virtual machine's file system, which potentially offers threat actors access to all their resources and the ability to perform any operations including launching EC2 instances and deleting S3 objects.

4. Overprivileged IAM roles

The research found about 33% of organizations grant full administrative privileges to over 10% of IAM roles in the cloud and 10% of them even grant those permissions to more than 40% of their roles.

5. Most companies don’t use separate roles for AWS Lambda functions

70% of organizations have at least two Lambda functions sharing the same IAM role, while almost 86% of all Lambda functions are sharing their IAM role. This violates the principle of least privilege and zero trust. The researchers recommend a 1:1 relationship between Lambda functions and IAM roles. Even if they start out with the same security policies, having separate IAM roles allows future flexibility.

Despite these risks being prevalent, the Orca Research Pod acknowledged that many understaffed security teams face a backlog of open security alerts. “This is hampering their ability to address risks in a timely manner, which is why prioritization of alerts, coupled with guided and automated remediation, are essential to overcome these challenges.”

Orca cloud security experts’ key recommendations

Based on their findings, Orca Security’s research team has recommended several actions to improve cloud security posture:

1. Adherence to the principle of least privilege and zero trust. “Ensure that administrator privileges are only given to those who really need them, and that regular users don’t have the power to escalate their own privileges or create new accounts,” they noted in the report. “Regularly review user policies to ensure that users are not given permissions they don’t strictly need.”
2. Never stop patching. All systems should be patched regularly to mitigate known vulnerabilities.
3. Use checklists for creating and configuring cloud assets, entitlements and resources, and implement policies that follow the best practices of Center for Internet Security (CIS) benchmarks.
4. Adopt automated cloud security platforms that can continually scan for risks and identify potential attack paths.
5. Use prioritization to avoid alert fatigue. “Security platforms typically generate many alerts,” researchers wrote. “When you consider that security teams — often understaffed and overworked, and working under heavy pressure — are generally monitoring several tools simultaneously, that’s a lot to handle. Although it will never be possible to fix all risks, it is important that you focus on those most critical.”