99 Percent Of All Misconfigurations In The Public Cloud Go Unreported

cloud-native-reportCharlie Osborne at ZDNet wrote: "Today's data breaches often seem to be caused not just by malware infections or external threat actors, but human error, insiders with an ax to grind, and simple security failures.

Some companies will bury their head in the sand, attempting to ignore responsible, private disclosures of data leaks, while others will act rapidly when their information -- and reputation -- is at stake.

The surge in adoption of cloud-based technologies and Infrastructure-as-a-Service (IaaS) has added a new facet to cyberthreats -- the loss of information caused by misconfigurations and weak credentials in the public cloud space.

According to new research released last week and conducted by cybersecurity firm McAfee, titled, "Cloud-Native: The Infrastructure-as-a-Service Adoption and Risk," the majority of IaaS misconfigurations are going unnoticed. 1,000 IT professionals were surveyed across 11 countries, and cloud usage data from over 30 million McAfee Mvision cloud users was aggregated to compile the report, which also says companies believe they average 37 IaaS misconfiguration issues per month when in reality this number can reach 3,500."

Just One Percent Of IaaS Issues Are Reported

That means that there are likely countless organizations worldwide that are leaking data but are unaware that they do. In total, 90 percent of respondents said they had come across security issues with IaaS, but only 26 percent said they were equipped to deal with misconfiguration audits -- and this lack of visibility into their cloud usage may be contributing to an increased data breach risk.

According to McAfee, IaaS-based data loss incidents triggered by data loss prevention (DLP) rules have increased by 248 percent year-over-year. As an example, the report says 42 percent of storage objects measured with recorded DLP incidents were misconfigured.

  • EBS Data Encryption
  • Unrestricted Outbound Access
  • EC2 Security Group Port Config
  • Provisioning Access to Resources using IAM Roles
  • Unrestricted Access to Non-Http/Https ports
  • Unrestricted Inbound Access on Uncommon Ports
  • Unused Security Groups
  • Unrestricted ICMP Access
  • EC2 Security Group Inbound Access Configuration
  • EC2 Instance Belongs to a VPC

Close to a quarter of survey respondents admitted it can take longer than 24 hours to correct reported misconfigurations, and in some serious cases, fixes can take over a month.

"In the rush toward IaaS adoption, many organizations overlook the shared responsibility model for the cloud and assume that security is taken care of completely by the cloud provider," said Rajiv Gupta, senior vice president of Cloud Security at McAfee. "However, the security of what customers put in the cloud, most importantly sensitive data, is their responsibility."

Evaluating The Vendors That Have Your Data

With the shift to cloud services, it becomes even more important to evaluate your vendors that have your data.  Many of these misconfigurations could be identified when you are evaluating a vendor before data is transferred.  However, all too often, a business unit may start "evaluating" a vendor prior to procurement or InfoSec involvement.  We are quick to blame the vendor, however, as Rajiv Gupta indicated, the onus is on the customer.

Request A Demo: Compliance Plus

Old-school compliance training is challenging for organizations to offer, difficult to do right, and is generally very expensive to deliver. In this live one-on-one demo we will show you how easy it is to deliver your compliance training program using Compliance Plus with KnowBe4's training platform.

CMP-Collage-LCompliance Plus gives you:

  • A whole new library with fresh compliance content updated regularly
  • Coverage of legislative requirements, such as HIPAA and many others
  • New-school high-quality customizable modules
  • Short, interactive modules to keep learners focused, newsletters, docs, and posters are all included
  • Completely automated compliance training campaigns with world-class support and extensive reporting

See for yourself how Compliance Plus can help you keep your users on their toes with compliance, risk and workplace safety top of mind!

Request A Demo

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews