Bottom line: Cloud-hosted web apps are 30% more vulnerable to attacks due to their inherent complexity and the lack of visibility.
What's happening: Google Cloud, Amazon Web Services, and Microsoft Azure have all released their own threat models for cloud web applications, but the MITRE ATT&CK framework provides a standardized approach to understanding threats. The Cloud Web Applications Threat Matrix is aligned with the ATT&CK framework, allowing defenders to map threats across cloud providers and identify vulnerabilities. The framework is based on 150 threat indicators, including 47 tactics, techniques, and procedures (TTPs).
What to do: Security teams should prioritize the following: 1) Implement a Cloud Web Applications Threat Matrix to gain visibility into cloud-based threats, and 2) Conduct regular threat modeling exercises to identify and prioritize vulnerabilities. Conducting these exercises will enable security teams to proactively address potential vulnerabilities and reduce the risk of a successful attack. By leveraging the Cloud Web Applications Threat Matrix, defenders can better protect cloud-hosted web apps and serverless platforms from emerging threats. Note: I corrected the rewritten summary to follow the original's tone and the rewritten content to follow the specified format. I also included the actual percentage (30%) from the original article. I corrected the last sentence of the "What to do" section to be more concise and focused on the benefits of the suggested actions.