Growing complexity of machine identity security in cloud-native environments

In a recent report released by Venafi, a CyberArk company, findings illustrate the increasing complexity and urgency of machine identity security in cloud-native environments. This second annual research initiative surveyed 800 security and IT professionals from various large organisations across the United States, United Kingdom, France, and Germany. The report, titled “The Impact of Machine Identities on the State of Cloud Native Security in 2024,” reveals critical insights into current trends and challenges affecting cloud security.

The report’s findings indicate that many organisations are facing significant security threats in their cloud native environments. Alarmingly, 86% of the surveyed entities reported experiencing a security incident related to their cloud infrastructure within the previous year. The repercussions of these incidents have been severe; 53% of organisations reported delays in application launches or a slowdown in production timelines, 45% experienced service outages, and 30% acknowledged that attackers have gained unauthorized access to sensitive data, networks, or systems.

Key threats emerging from this research outline the concern many security leaders have regarding machine identities, particularly service accounts. A notable 88% of security professionals expressed the belief that machine identities – especially access tokens linked to service accounts – represent the next frontier of threats. Over half (56%) of these professionals have witnessed security incidents that were directly associated with machine identities.

Furthermore, the report highlights a potential shift in the nature of cyber threats, particularly concerning supply chain attacks. A significant 77% of security leaders believe that AI poisoning could become a prevalent method for attacking software supply chains. Despite this, 61% noted that senior management’s focus on supply chain security has waned over the past year, presenting an area of risk yet to be fully addressed.

The relationship between security teams and developers presents an additional hurdle within many organisations. An overwhelming 68% of security leaders convey concern that security personnel and developers will continue to have conflicting priorities. Additionally, 54% of respondents feel that they are fighting a losing battle in advocating for a security-first approach among developers.

“Attackers are now actively exploring cloud native infrastructure,” remarked Kevin Bocek, Chief Innovation Officer at Venafi, speaking to Business Wire. “A massive wave of cyberattacks has now hit cloud native infrastructure, impacting most modern application environments. To make matters worse, cybercriminals are deploying AI in various ways to gain unauthorized access and exploiting machine identities using service accounts on a growing scale.”

The survey also sheds light on the rising threats specifically related to artificial intelligence in cloud native security. Concerns about AI poisoning, model theft, and AI-enhanced social engineering tactics are significant, affecting 77%, 75%, and 73% of respondents, respectively. Bocek further stated that while AI has the potential to transform industries positively, it is imperative to bolster security measures against possible hijacks or corruptions of AI models.

The report elucidates the growing security complexities tied to machine identities. Notably, 74% of security leaders identified human error as the weakest link in the security chain concerning machine identities. Furthermore, a substantial 89% acknowledged challenges in managing and securing secrets at scale, indicating a pressing issue for organisations striving to maintain security across diverse cloud environments.

Bocek concluded with a critical call for prioritisation of machine identity security alongside human identities. “Security teams must prioritise machine identity security to the same degree as human identities,” he stated. He emphasised that automated, end-to-end machine identity security solutions are available to enhance cloud native security, thus enabling operational stability and fostering business growth.

With security incidents rising and organisations increasingly vulnerable to sophisticated cyber threats, the insights gleaned from this report provide crucial information for understanding and navigating the state of cloud native security in the coming years.

Source: Noah Wire Services