Don’t Be Caught Unsecured

Don’t Be Caught Unsecured

The cloud has revolutionized operations; don’t be misconfigured

Over the last decade, the cloud has revolutionized the way businesses operate. Today, modern enterprises are turning to a hybrid IT environment, leveraging the best of both worlds—the scalability of cloud infrastructure and the control of on-premises systems. Reduced operating costs, greater flexibility and agility are immense benefits for any organization, not to mention a significant competitive advantage, but they are not easily attained without overcoming unique security challenges and risks.

Hybrid environments can quickly multiply the complexity of an already complicated infrastructure. It’s a combination of services completely owned and managed by an internal team, plus services completely owned and managed by cloud service providers (CSP). With different environments in play, enterprises must integrate multiple applications and systems, which often requires entirely different skill sets. With so many moving pieces, it can be extremely difficult to maintain proper visibility across the different environments, and quite easy to inadvertently leave data exposed.

When it comes to securing this data, perhaps one of the biggest mistakes organizations are guilty of today is overlooking basic security controls. A simple misconfiguration in cloud services can leave even the most security-minded organizations exposed and vulnerable to malicious actors. This little mishap can expose sensitive data, including passwords, personally identifiable information (PII) and other types of information, which could damage customers, employees and the company’s reputation.

Here are the key considerations for avoiding the most common misconfiguration errors in the cloud, and the important steps to take to keep every component of your hybrid IT environment secure.

Rising Cloud Misconfiguration Breaches

Data breaches by way of cloud misconfigurations continue to make headlines day after day.

In July 2017, as many as 14 million Verizon customer records were left exposed as a result of an unsecured server. This information contained customer names, phone numbers and account PIN codes—all publicly available online.

Similarly, data firm Deep Root Analytics left personal data exposed after storing it on a cloud server configured to be made publicly accessible. Working on behalf of the Republican National Committee (RNC), this included information containing the personal details of 198 million U.S. voters.

Shortly thereafter, Dow Jones experienced a data leak when it left a server accessible to anyone with a free Amazon Web Services (AWS) account—not just Dow Jones-associated accounts. The breach involved a database containing the personal information of over two million customers.

These are only a few recent examples but it’s evident these errors are happening too often, most of which could have been easily corrected.

Common Misconfiguration Mistakes

According to a report released by RedLock in October 2017, more than half (53 percent) of organizations that use cloud storage services like Amazon S3 admitted to accidentally exposing at least one such service to the public. Meanwhile, in OWASPS’s annual list of the top 10 most application security risks, security misconfiguration was ranked in the top five.

As more organizations move operations to the cloud, security misconfigurations are attackers’ “low hanging fruit” and among the most frequent loopholes that they leverage to gain easy access to an organization. For this reason, both the SANS Institute and the Council on Cybersecurity (CCS) recommend that once organizations create an inventory of hardware and software, the most important security control is securing configurations.

So, why are these misconfigurations so common? Security misconfigurations are easy mistakes to make. Cloud vendors have worked to make access configurations as flexible as possible, but that has also made it very easy to inadvertently expose cloud environments (buckets) and the data inside them. These buckets can be accessed simply through a URL, as long as the user has the appropriate permissions.

Misconfiguration is also more likely to occur during the process of changes to security; for instance, when new rules are added to a cloud environment, or when the existing rules are being altered or replaced. They can occur at any level of the application stack— the platform, web server, database, framework, and custom code.

It is also common for attackers to take advantage of poorly configured devices, such as those using default passwords. Attackers are looking for systems that have default settings that are immediately vulnerable, and once an attacker exploits a system, they can start making changes and exfiltrating data. If there is a small error in a security system, for instance, the use of default settings or unhardened security, it could provide access to an unauthorized, and potentially malicious third-party.

Preventing Security Configuration Errors

Unfortunately, human error rests at the core of misconfigurations. Yet, although they are easy to exploit, there are many proactive steps organizations can take to prevent the frequency of these mistakes.

There’s a common misconception that cloud providers handle security. When adopting cloud services, it is critical to understand what IT security is being provided by the cloud provider, and what security is the responsibility of the organization. For example, the secure configuration of the services and applications being used in addition to vendor-provided services will likely be the responsibility of users, not the vendor. Be sure to understand the vendor’s shared security responsibility model. Ultimately, each party is accountable for different aspects of IT security and both parties must work together to achieve complete coverage.

One of the most important pillars to preventing these kinds of incidents is a strong secure configuration management process. By setting standard configurations for systems based on industry best practices and continuously monitoring for changes from that baseline, organizations can quickly identify a misconfiguration that could be exploited—before a breach occurs. In fact, The Center for Internet Security (CIS) has created the CIS Amazon Web Services Foundations benchmark policy, which provides guidance on best practice security configuration options within the AWS management console.

A secure configuration management (SCM) solution can help organizations accomplish this efficiently and effectively, especially in such complex environments. Some of the highest profile breaches could have been prevented from taking this foundational step.

Experts continue to stress that the latest security tools can be useless, if the basic essentials of security are not met. In addition to secure configuration, organizations should build out a stronger foundation by checking and fixing vulnerabilities (lack of patching known vulnerabilities is another simple cause for high-profile incidents), managing administrative privileges carefully, and paying attention to audit logs.

Don’t Let a Simple Mistake Lead to Big Consequences

While environments continue to evolve, the foundational tenets of security remain the same: maintain visibility of your attack surface, minimize your attack surface, and continue to monitor it. The critical security controls applied in your traditional environments should be applied just the same in cloud environments. Growing complexity is not an excuse to brush security bestpractices aside.

There is security technology available today to meet the modernization of hybrid enterprises—technology that automates the assessment, monitoring, and management of configurations across all systems to ensure ongoing security and compliance.

Don’t let something as simple as a misconfiguration leave your data exposed.

This article originally appeared in the June 2018 issue of Security Today.

Featured

  • Unlocking the Possibilities

    Security needs continue to evolve and end users are under pressure to address emerging risks and safety concerns. For many, that focus starts with upgrading perimeter openings and layering technologies—beginning at the door. Read Now

  • Freedom of Choice

    In today's security landscape, we are witnessing a fundamental transformation in how organizations manage digital evidence. Law enforcement agencies, campus security teams, and large facility operators face increasingly complex challenges with expanding video data, tightening budget constraints and inflexible systems that limit innovation. Read Now

  • Accelerating a Pathway

    There is a new trend touting the transformational qualities of AI’s ability to deliver actionable data and predictive analysis that in many instances, seems to be a bit of an overpromise. The reality is that very few solutions in the cyber-physical security (CPS) space live up to this high expectation with the one exception being the new generation of Physical Identity and Access Management (PIAM) software – herein recategorized as PIAM+. Read Now

  • Protecting Your Zones

    It is game day. You can feel the crowd’s energy. In the parking lot. At the gate. In the stadium. On the concourse. Fans are eager to party. Food and merchandise vendors ready themselves for the rush. Read Now

  • Street Smarts

    The ongoing acceptance of AI and advanced data analytics has allowed surveillance camera technology to shift from being a tactical tool to a strategic business solution. Combining traditional surveillance technology with AI-based data-driven insights can streamline transportation systems, enhance traffic management, improve situational awareness, optimize resource allocation and streamline emergency response procedures. Read Now

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.