Cyber Defense eMagazine March Edition for 2022

Here are five reasons that organizations need to secure directory services in a hybrid deployment.
1. As cloud use grows, attackers are following the data
In October 2021, Microsoft reported that Azure and other cloud services grew 50% year over year in Q4
2021 and have grown between 47% and 62% every quarter since Q2 2020. The Covid-19 pandemic
accelerated the shift to the cloud across many industries, and the momentum hasn’t slowed down. As
data has moved to the cloud, malware has followed. A survey of CISOs conducted by IDC in mid-2021
found that 98% of respondents suffered at least one cloud data breach in the previous 18 months as
opposed to 79% in 2020. There’s every reason to believe that adversaries will continue to target the cloud
aggressively in 2022. Security and cloud teams should ensure they are not leaving gaps that attackers
can exploit in their identity and access management infrastructure that make it easier for adversaries to
target them.
2. The rapid rate of change in the cloud creates uncertainty and risk
Cloud platforms are still being actively developed, which means the underlying software changes
frequently, Cloud products and tools get merged with other products, removed, or overhauled on a regular
basis. This volatility increases security risk because it prevents security experts, whether they work inhouse,
for a service provider or as a consultant, from understanding the cloud platform in detail. Every
time something changes, security pros need to re-learn how it works, what its weaknesses are and how
to protect it. Until they do, they’re more likely to make mistakes, overlook security gaps or implement
insecure misconfigurations. Since cloud platforms are relatively new compared to on-premises software,
the talent pool and library of third-party resources for securing them are small to start with. These factors
make the cloud especially risky, and forces organizations to continuously revise their cloud security
policies - increasing the changes something will slip through the cracks.
For comparison, Microsoft Active Directory has been used for identity and access management onpremises
for two decades. There are a huge number of AD admins that understand the software inside
and out and an enormous library of third-party resources to help them do their job quickly and safely.
While many organizations still struggle to secure AD on-premises, AD security in the cloud has additional
barriers to security that make it even more important that security and cloud teams take it seriously.
3. The cloud has a larger attack surface and authentication is more complex than
on-premises
Cloud authentication systems are easier for attackers to exploit in some ways. First, they simply have a
larger attack surface. These systems are exposed to the internet by default, where on-premises AD is
closed to the internet by default. With on-premises AD, adversaries first needed access to the network
through a user’s credentials. In the cloud, they don’t even need that.
The systems that assign permissions to specific users or groups in the major cloud platforms also tend
to be more complex than they are in on-premises AD. For example, Azure AD uses at least three separate
Cyber Defense eMagazine – March 2022 Edition 68
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.