Report: Remote Work, Cloud Reliance Increases Attack Surface

A new report from cybersecurity software company Zscaler finds that remote work presents significant cyber risk to corporate and cloud infrastructures.

The report from the San Francisco-based provider of the SASE-based Zero Trust Exchange analyzed the attack surface of 1,500 organizations and uncovered more than 202,000 vulnerabilities from, nearly half of which are classified as critical or high severity.

According to the report, nearly 400,000 servers of those 1,500 companies were exposed and discoverable over the internet, with 47% of supported protocols being outdated and vulnerable.

ZScaler’s findings also included exposures in public cloud infrastructure with over 60,600 exposed from AWS, Microsoft Azure Cloud and Google Cloud Platform.

The report’s findings provide an inside look into how exactly remote and hybrid work impact any organization’s cybersecurity posture and includes recommendations on what organizations can do to reduce their vulnerabilities and still roll out a successful hybrid work program.

The report suggests that organizations relying on public cloud services and enterprise VPNs while not implementing zero trust are far more vulnerable to attacks.

In fact, international organizations with more than 20,000 employees are more vulnerable to their already distributed workforce, infrastructure and amount of applications that need to be managed by IT.

Although 59% of the organizations surveyed were based in the Americas, EMEA businesses were the most vulnerable to attack, as those businesses had 164 CVE vulnerabilities and an average of 283 exposed servers and 52 exposed public cloud instances each, leading the other regions in those categories.

Those businesses were also more likely to support outdated SSL/TLS protocols and had a greater risk of CVE vulnerabilities on average.

The Americas and APAC regions followed with 132 and 80 CVEs, respectively.

The report also analyzed the risk of 23 different industries, finding that telecommunications companies were the most vulnerable and had the highest average number of outdated protocols in their servers. That industry also had the third highest average of exposed servers, increasing the risk of DDoS and double extortion ransomware attacks.

Meanwhile, the hospitality industry had the highest average of exposed services and cloud instances, with AWS instances exposed nearly three times more often than other cloud providers. That is attributed to the restaurant industry’s move to online ordering.

ZScaler’s recommendations:

The company says organizations should implement zero trust, and promotes its Zero Trust Exchange in the report. Consider checking out Zscaler’s zero trust offerings.
Find out your risk of exposure. Understanding your attack surface is the first step in securing your data in the first place, especially as applications continue to move to the cloud.
VPNs and firewalls are just part of the solution. In fact, Zscaler says they can increase your attack surface. Instead, you should stay current on the CVE database and remove support for older TLS versions from servers.

If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!