The Toxic Cloud Trilogy

As Indian organisations increasingly migrate to the cloud, they face a complex and evolving security landscape. Ari Eitan, Director of Research at Tenable, highlights the "Toxic Cloud Trilogy" - a convergence of publicly exposed workloads, critical vulnerabilities, and over-privileged identities - as a critical threat to Indian organisations. In this interview, Eitan discusses the unique vulnerabilities of cloud environments, systemic issues preventing organisations from fully addressing weaknesses and practical steps Indian organisations can take to mitigate these risks.

- Aanchal Ghatak

Could you explain what the “toxic cloud trilogy” entails and why it poses such a critical threat to indian organisations?

The toxic cloud trilogy is a convergence of publicly exposed workloads, critical vulnerabilities, and overprivileged identities. Separately, each of these factors poses a security risk. Together, they create a scenario that warrants attention.

In the cloud, publicly exposed workloads can function as beacons, accessible from the internet. Such exposure, even when unintentional, allows cybercriminals to identify potential entry points with ease. Add unpatched vulnerabilities into the mix, and the risk is amplified. These gaps create a straightforward exploitation pathway.

The third factor – over-privileged identities – further raises the stakes. When access permissions exceed what is necessary, attackers can move more freely across systems, accessing data and services with fewer barriers. This toxic cloud trilogy turns what might have been a limited security issue into a broader operational concern, allowing attackers to extend their reach if they gain access.

Many organisations continue to face challenges in securing cloud data effectively. What specific aspects of the cloud make it uniquely vulnerable, particularly in complex environments?

It’s much easier to store data in the cloud because every time organisations want to store new data, they can increase cloud storage with the click of a button. With data storage becoming easier, organisations are motivated to store more data that they can leverage to advance their AI capabilities. Over the last few years, LLMs have become more accessible, introducing new challenges.