As cloud adoption becomes more critical to business transformation today, enterprises need to look beyond their routine malware and vulnerability scans. In 2024, cloud environments will be a playground for tailor-made worms crafted to exploit cloud technologies and misconfigurations will serve as an easy entry point for attackers.

With just a single successful exploit, particularly through misconfigured APIs in the likes of Kubernetes, Docker, and WeaveScope, attacks with worming capabilities can set off rapid propagation in cloud environments. In short, these worm attacks use interconnectivity — the very benefit for which the cloud was made — against cloud environments.

Data poisoning will make machine-learning (ML) models an exciting and expansive attack surface for threat actors to explore as these promise a wide variety of high rewards with very few risks. A compromised ML model can open the floodgates to possibly divulging confidential data for extraction, writing malicious instructions, and providing biased content that could lead to user dissatisfaction or potential legal repercussions.

Validating and authenticating training datasets will become increasingly imperative, especially while ML remains an expensive integration for many businesses. Enterprises who take their algorithms off-premises to lower cost will also be more vulnerable since they rely on sourced data from third-party data lakes and federated learning systems. This means that they are completely dependent on datasets stored within cloud storage services guarded by systems outside their own.

As technological innovations continue to simplify business operations, the attack surface also branches out for threat actors. An increase in software supply-chain attacks will solidify the need for enterprises to implement application security tools to gain visibility over their continuous integration and continuous delivery (CI/CD) systems.

Cybercriminals can take advantage of providers with weak defenses to gain access to widely used software and find their way into supply chain vendors. Ultimately, however, they will wreak the most havoc for end users. In 2024, vendors need to anticipate that ambitious threat actors will strike at the source — the very code on which IT infrastructures are built — with attacks that will persistently focus on third-party components like libraries, pipelines, and containers.