Don’t Be Caught Unsecured
The cloud has revolutionized operations; don’t be misconfigured
- By David Meltzer
- Jun 01, 2018
Over the last decade, the cloud has revolutionized the
way businesses operate. Today, modern enterprises
are turning to a hybrid IT environment, leveraging
the best of both worlds—the scalability of cloud infrastructure
and the control of on-premises systems.
Reduced operating costs, greater flexibility and agility are immense
benefits for any organization, not to mention a significant competitive
advantage, but they are not easily attained without overcoming
unique security challenges and risks.
Hybrid environments can quickly multiply the complexity of an
already complicated infrastructure. It’s a combination of services
completely owned and managed by an internal team, plus services
completely owned and managed by cloud service providers (CSP).
With different environments in play, enterprises must integrate multiple
applications and systems, which often requires entirely different
skill sets. With so many moving pieces, it can be extremely difficult
to maintain proper visibility across the different environments, and
quite easy to inadvertently leave data exposed.
When it comes to securing this data, perhaps one of the biggest
mistakes organizations are guilty of today is overlooking basic security
controls. A simple misconfiguration in cloud services can leave
even the most security-minded organizations exposed and vulnerable
to malicious actors. This little mishap can expose sensitive data, including
passwords, personally identifiable information (PII) and other
types of information, which could damage customers, employees
and the company’s reputation.
Here are the key considerations for avoiding the most common
misconfiguration errors in the cloud, and the important steps to take
to keep every component of your hybrid IT environment secure.
Rising Cloud Misconfiguration Breaches
Data breaches by way of cloud misconfigurations continue to make
headlines day after day.
In July 2017, as many as 14 million Verizon customer records were
left exposed as a result of an unsecured server. This information contained
customer names, phone numbers and account PIN codes—all
publicly available online.
Similarly, data firm Deep Root Analytics left personal data exposed
after storing it on a cloud server configured to be made publicly
accessible. Working on behalf of the Republican National Committee
(RNC), this included information containing the personal
details of 198 million U.S. voters.
Shortly thereafter, Dow Jones experienced a data leak when
it left a server accessible to anyone with a free Amazon Web Services
(AWS) account—not just Dow Jones-associated accounts. The
breach involved a database containing the personal information of
over two million customers.
These are only a few recent examples but it’s evident these errors are
happening too often, most of which could have been easily corrected.
Common Misconfiguration Mistakes
According to a report released by RedLock in October 2017, more than half (53 percent) of organizations that
use cloud storage services like Amazon S3
admitted to accidentally exposing at least
one such service to the public. Meanwhile, in
OWASPS’s annual list of the top 10 most application
security risks, security misconfiguration
was ranked in the top five.
As more organizations move operations
to the cloud, security misconfigurations are
attackers’ “low hanging fruit” and among
the most frequent loopholes that they leverage
to gain easy access to an organization.
For this reason, both the SANS Institute
and the Council on Cybersecurity (CCS)
recommend that once organizations create
an inventory of hardware and software, the
most important security control is securing
So, why are these misconfigurations so
common? Security misconfigurations are
easy mistakes to make. Cloud vendors have
worked to make access configurations as
flexible as possible, but that has also made
it very easy to inadvertently expose cloud
environments (buckets) and the data inside
them. These buckets can be accessed simply
through a URL, as long as the user has the
Misconfiguration is also more likely to
occur during the process of changes to security;
for instance, when new rules are added
to a cloud environment, or when the existing
rules are being altered or replaced. They can
occur at any level of the application stack—
the platform, web server, database, framework,
and custom code.
It is also common for attackers to take
advantage of poorly configured devices, such
as those using default passwords. Attackers
are looking for systems that have default settings
that are immediately vulnerable, and
once an attacker exploits a system, they can
start making changes and exfiltrating data.
If there is a small error in a security system,
for instance, the use of default settings or unhardened
security, it could provide access to
an unauthorized, and potentially malicious
Unfortunately, human error rests at the core
of misconfigurations. Yet, although they are
easy to exploit, there are many proactive
steps organizations can take to prevent the
frequency of these mistakes.
There’s a common misconception that
cloud providers handle security. When
adopting cloud services, it is critical to understand
what IT security is being provided
by the cloud provider, and what security is
the responsibility of the organization. For
example, the secure configuration of the services
and applications being used in addition
to vendor-provided services will likely be the
responsibility of users, not the vendor. Be
sure to understand the vendor’s shared security
responsibility model. Ultimately, each
party is accountable for different aspects of
IT security and both parties must work together
to achieve complete coverage.
One of the most important pillars to
preventing these kinds of incidents is a
strong secure configuration management
process. By setting standard configurations
for systems based on industry best
practices and continuously monitoring for
changes from that baseline, organizations
can quickly identify a misconfiguration that
could be exploited—before a breach occurs.
In fact, The Center for Internet Security
(CIS) has created the CIS Amazon Web Services
Foundations benchmark policy, which
provides guidance on best practice security
configuration options within the AWS management
A secure configuration management
(SCM) solution can help organizations accomplish
this efficiently and effectively,
especially in such complex environments.
Some of the highest profile breaches could
have been prevented from taking this foundational
Experts continue to stress that the latest
security tools can be useless, if the basic
essentials of security are not met. In addition
to secure configuration, organizations
should build out a stronger foundation by
checking and fixing vulnerabilities (lack of
patching known vulnerabilities is another
simple cause for high-profile incidents), managing
administrative privileges carefully, and
paying attention to audit logs.
Don’t Let a Simple
Mistake Lead to Big
While environments continue to evolve, the
foundational tenets of security remain the
same: maintain visibility of your attack
surface, minimize your attack surface, and
continue to monitor it. The critical security
controls applied in your traditional environments
should be applied just the same
in cloud environments. Growing complexity
is not an excuse to brush security bestpractices
There is security technology available
today to meet the modernization of hybrid
enterprises—technology that automates the
assessment, monitoring, and management
of configurations across all systems to ensure
ongoing security and
Don’t let something as
simple as a misconfiguration
leave your data exposed.
This article originally appeared in the June 2018 issue of Security Today.