Cloud attacks proving effective

In a study encompassing the first half of 2019, Proofpoint researchers analyzed data from more than one thousand cloud service tenants with over 20 million user accounts. (Tenants are single cloud service deployments in an organization – one organization may be associated with multiple tenants: for example, a G Suite deployment for one department in addition to a corporate Microsoft Office 365 subscription.) The company observed over 15 million unauthorized login attempts (or “attacks”), out of which over 400,000 resulted in successful logins.

Thursday, 26th September 2019 Posted 5 years ago in by Phil Alsop

Although Proofpoint observed large-scale cloud attacks targeting all industries, several trends emerged during the course of this study. Among the industries evaluated, the education and food and beverage sectors were notably vulnerable to successful unauthorized logins. Regulated industries such as healthcare and financial services protected themselves better in comparison, with significantly lower rates of successful attacks. The Fortune 500 companies in the study were heavily targeted and 60% of them experienced at least one compromised cloud account. Certain identified roles including sales representatives and managers were targeted across all industries, presumably because their emails tend to be publicly available and their positions give them access to finance managers, customers, and partners.

In addition to these industry trends, researchers observed the following:

85% of organizations were targeted at least once by threat actors
45% of organizations experienced at least one compromised cloud account.
6% of organizations had an unauthorized login to an executive account
At organizations with compromised cloud accounts, on average 13 active accounts per organization experienced successful unauthorized logins
0.6% of active user accounts were targeted at least once

Taken together, this data demonstrates that threat actors have about a 50% chance of successfully accessing an organization via cloud accounts; history demonstrates that a single compromised account can have a significant impact on an organization’s security.