Datadog's State of Cloud Security 2024 Finds Room for Improvement in the Use of Long-Lived Credentials Across All Major Clouds

Rhea-AI Summary

Datadog's State of Cloud Security 2024 report reveals significant security risks associated with long-lived credentials across major cloud providers. Key findings include:

- 46% of organizations use unmanaged users with long-lived credentials

- 62% of Google Cloud service accounts, 60% of AWS IAM users, and 46% of Microsoft Entra ID applications have access keys older than one year

- 79% of S3 buckets are covered by Public Access Block, up from 73% last year

- 18% of AWS EC2 instances and 33% of Google Cloud VMs have sensitive project permissions

- 10% of third-party integrations have risky cloud permissions

The report emphasizes the need for modern authentication mechanisms, short-lived credentials, and active monitoring of APIs to enhance cloud security.

Positive

• Adoption of cloud guardrails is increasing, with 79% of S3 buckets now covered by Public Access Block, up from 73% last year
• Datadog's report provides valuable insights for companies to improve their cloud security posture

Negative

• 46% of organizations are still using unmanaged users with long-lived credentials, posing a major security risk
• 62% of Google Cloud service accounts, 60% of AWS IAM users, and 46% of Microsoft Entra ID applications have access keys older than one year
• 18% of AWS EC2 instances and 33% of Google Cloud VMs have sensitive permissions to a project, increasing the risk of credential theft
• 10% of third-party integrations have risky cloud permissions, potentially allowing unauthorized access to all data in the account
• 2% of third-party integration roles don't enforce the use of External IDs, making them vulnerable to 'confused deputy' attacks

Insights

Cloud Security Expert

The State of Cloud Security 2024 report highlights significant vulnerabilities in cloud security practices, particularly the widespread use of long-lived credentials. This is a critical issue as 46% of organizations are using unmanaged users with these persistent credentials, which pose substantial risks.

The prevalence of outdated credentials is alarming, with 60-62% of service accounts and users across major cloud providers having access keys older than a year. This increases the attack surface for potential breaches. However, there's a positive trend in the adoption of cloud guardrails, with 79% of S3 buckets now protected by access blocks, up from 73% last year.

The report also reveals concerning statistics about excessive permissions:

• 18% of AWS EC2 instances and 33% of Google Cloud VMs have sensitive project-wide permissions
• 10% of third-party integrations have risky cloud permissions
• 2% of third-party integration roles don't enforce External IDs

These findings underscore the urgent need for organizations to implement more robust identity and access management practices, including the use of short-lived credentials and active monitoring of API changes.

Cybersecurity Analyst

The Datadog report unveils critical vulnerabilities in cloud security practices that could have significant implications for businesses. The persistent use of long-lived credentials across major cloud providers is particularly concerning, as it increases the risk of credential leakage and subsequent breaches.

What's particularly alarming is the age of these credentials. With 60-62% of access keys being older than a year, organizations are essentially leaving their digital doors unlocked. This practice goes against cybersecurity best practices, which recommend regular rotation of credentials.

The excessive permissions granted to cloud instances and third-party integrations further compound the risk. If compromised, these could lead to large-scale data theft or account takeovers. The 2% of third-party integration roles not enforcing External IDs is a glaring vulnerability that could be exploited through confused deputy attacks.

On a positive note, the increased adoption of cloud guardrails, particularly for S3 buckets, shows that some progress is being made. However, organizations need to accelerate their efforts in implementing modern authentication mechanisms and actively monitoring for suspicious API activities to mitigate these risks effectively.

The report found that 46% of organizations are using unmanaged users with long-lived credentials

NEW YORK, Oct. 21, 2024 /PRNewswire/ -- Datadog, Inc. (NASDAQ: DDOG), the monitoring and security platform for cloud applications, today announced its new report, the State of Cloud Security 2024. The report found that long-lived credentials continue to be a major risk for organizations across all cloud providers.

Long-lived cloud credentials never expire and frequently get leaked in source code, container images, build logs and application artifacts, making them a major security risk. Research has shown that they are the most common cause of publicly documented cloud security breaches. While the risks are well documented, Datadog's report found that almost half (46%) of organizations are still using unmanaged users with long-lived credentials.

According to the report, not only are long-lived credentials widespread across all major clouds, they are also often old and even unused. 62% of Google Cloud service accounts, 60% of AWS IAM users and 46% of Microsoft Entra ID applications have an access key older than one year.

"The findings from the State of Cloud Security 2024 suggest it is unrealistic to expect that long-lived credentials can be securely managed," said Andrew Krug, Head of Security Advocacy at Datadog. "In addition to long-lived credentials being a major risk, the report found that most cloud security incidents are caused by compromised credentials. To protect themselves, companies need to secure identities with modern authentication mechanisms, leverage short-lived credentials and actively monitor changes to APIs that attackers commonly use."

Other key findings from the report include:

• Adoption of cloud guardrails is on the rise—79% of S3 buckets are covered by an account-wide or bucket-specific S3 Public Access Block, up from 73% a year ago—thanks to cloud providers starting to enable guardrails by default.
• More than 18% of AWS EC2 instances and 33% of Google Cloud VMs have sensitive permissions to a project. This puts organizations at risk as any attacker compromising the workload is able to steal associated credentials and access the cloud environment.
• 10% of third-party integrations have risky cloud permissions, allowing the vendor to access all data in the account or to take over the whole AWS account. 2% percent of third-party integration roles don't enforce the use of External IDs, which allows an attacker to compromise them through a "confused deputy" attack.

For the report, Datadog analyzed security posture data from a sample of thousands of organizations using AWS, Azure or Google Cloud.

Datadog's State of Cloud Security 2024 is available now. To dive deeper into the findings, read the blog. Learn more about how Datadog helps companies secure their cloud environments.

About Datadog

Datadog is the observability and security platform for cloud applications. Our SaaS platform integrates and automates infrastructure monitoring, application performance monitoring, log management, user experience monitoring, cloud security and many other capabilities to provide unified, real-time observability and security for our customers' entire technology stack. Datadog is used by organizations of all sizes and across a wide range of industries to enable digital transformation and cloud migration, drive collaboration among development, operations, security and business teams, accelerate time to market for applications, reduce time to problem resolution, secure applications and infrastructure, understand user behavior and track key business metrics.

Forward-Looking Statements

This press release may include certain "forward-looking statements" within the meaning of Section 27A of the Securities Act of 1933, as amended, or the Securities Act, and Section 21E of the Securities Exchange Act of 1934, as amended including statements on the benefits of new products and features. These forward-looking statements reflect our current views about our plans, intentions, expectations, strategies and prospects, which are based on the information currently available to us and on assumptions we have made. Actual results may differ materially from those described in the forward-looking statements and are subject to a variety of assumptions, uncertainties, risks and factors that are beyond our control, including those risks detailed under the caption "Risk Factors" and elsewhere in our Securities and Exchange Commission filings and reports, including the Quarterly Report on Form 10-Q filed with the Securities and Exchange Commission on May 8, 2024, as well as future filings and reports by us. Except as required by law, we undertake no duty or obligation to update any forward-looking statements contained in this release as a result of new information, future events, changes in expectations or otherwise.

Contact
Dan Haggerty
press@datadoghq.com

View original content to download multimedia:https://www.prnewswire.com/news-releases/datadogs-state-of-cloud-security-2024-finds-room-for-improvement-in-the-use-of-long-lived-credentials-across-all-major-clouds-302282005.html

SOURCE Datadog, Inc.

FAQ

What percentage of organizations are using unmanaged users with long-lived credentials according to Datadog's report?

According to Datadog's State of Cloud Security 2024 report, 46% of organizations are using unmanaged users with long-lived credentials.

How many S3 buckets are covered by Public Access Block in 2024 compared to the previous year?

The report states that 79% of S3 buckets are covered by an account-wide or bucket-specific S3 Public Access Block in 2024, up from 73% a year ago.

What percentage of AWS EC2 instances have sensitive permissions to a project, according to Datadog's report?

Datadog's report reveals that more than 18% of AWS EC2 instances have sensitive permissions to a project.

What percentage of third-party integrations have risky cloud permissions according to the State of Cloud Security 2024 report?

The report indicates that 10% of third-party integrations have risky cloud permissions, allowing potential access to all data in the account or takeover of the whole AWS account.

What is the main security risk highlighted in Datadog's (DDOG) State of Cloud Security 2024 report?

The main security risk highlighted in Datadog's report is the widespread use of long-lived credentials across all major cloud providers, which pose a significant security threat to organizations.