【研报】2024年云原生安全报告（英）.docx

2024REPORT

TheStateofCloud-NativeSecurity

PAGE2The

PAGE2

TheStateofCloud-NativeSecurity

EXECUTIVESUMMARY

ARetrospectonthePreviousYear

Webeginourexplorationofthe2024stateofcloud-nativesecuritywithalookbackattheeventsandinfluencesof2023,eachofwhichfactorsintoourcurrentpostures,thechallengesweconfront,andthestrategieswe’vechosentoachieveourdesiredoutcomes.

Whileagiledevelopment,open-sourcesoftware,andcloud-nativetechnologiesgainedmomentumin2023,attackstargetingtheapplicationlayerhavebecomeanestablishedtrend.The

cloud-nativeecosystemgrappledwithasurgeinsupplychainattacks,highlightingtheprevalenceofvulnerabilitiesin

open-sourcesoftwareandthird-partylibraries.Real-worlddataanalyzedbyourUnit42teamenhancedthispicture,identifyingthecloudasthedominantattacksurface,with80%ofmedium,high,andcriticalexposuresfoundincloud-hostedassets.1

Forsometime,we’veprioritizedapplicationandinfrastructuresecurity.Butwemustn’tforgetthatthird,

all-importantballintheair.Withtheglobaldataspherereaching120zettabytesin2023,2securingsensitivedataremainsmissioncritical.Thechallengesofmonitoringandcontrollingsensitiveinformation,however,haveescalated.

1CortexXpanseASMThreatReport2023

2DataCreatedWorldwide2010-2025

Cloudsecurityisasmuchabusinessgoal asanythingelseweendeavortoachieve.

What’smore,generativeAIemergedin2023asagroundbreakingforcewiththepotentialtohalvedevelopmenttimeandcosts,ultimatelyredefiningtheapplicationeconomy.3Butmuchlikethe

cloudanditsmyriadbenefitsinextricablytiedtochallengeswemustaddress,generativeAIasadevelopmenttoolcomescounterweightedwithconcerns.WehadnosoonerbeguntowonderaboutpotentialissueswhenOWASPreleasedtheTop10LLMSecurityRisksforsecurityteams,alertingustopromptinjection,insecureoutputhandling,

an