Charlie Osborne at ZDNet wrote: "Today's data breaches often seem to be caused not just by malware infections or external threat actors, but human error, insiders with an ax to grind, and simple security failures.
Some companies will bury their head in the sand, attempting to ignore responsible, private disclosures of data leaks, while others will act rapidly when their information -- and reputation -- is at stake.
The surge in adoption of cloud-based technologies and Infrastructure-as-a-Service (IaaS) has added a new facet to cyberthreats -- the loss of information caused by misconfigurations and weak credentials in the public cloud space.
According to new research released last week and conducted by cybersecurity firm McAfee, titled, "Cloud-Native: The Infrastructure-as-a-Service Adoption and Risk," the majority of IaaS misconfigurations are going unnoticed. 1,000 IT professionals were surveyed across 11 countries, and cloud usage data from over 30 million McAfee Mvision cloud users was aggregated to compile the report, which also says companies believe they average 37 IaaS misconfiguration issues per month when in reality this number can reach 3,500."
Just One Percent Of IaaS Issues Are Reported
That means that there are likely countless organizations worldwide that are leaking data but are unaware that they do. In total, 90 percent of respondents said they had come across security issues with IaaS, but only 26 percent said they were equipped to deal with misconfiguration audits -- and this lack of visibility into their cloud usage may be contributing to an increased data breach risk.
According to McAfee, IaaS-based data loss incidents triggered by data loss prevention (DLP) rules have increased by 248 percent year-over-year. As an example, the report says 42 percent of storage objects measured with recorded DLP incidents were misconfigured.
- EBS Data Encryption
- Unrestricted Outbound Access
- EC2 Security Group Port Config
- Provisioning Access to Resources using IAM Roles
- Unrestricted Access to Non-Http/Https ports
- Unrestricted Inbound Access on Uncommon Ports
- Unused Security Groups
- Unrestricted ICMP Access
- EC2 Security Group Inbound Access Configuration
- EC2 Instance Belongs to a VPC
Close to a quarter of survey respondents admitted it can take longer than 24 hours to correct reported misconfigurations, and in some serious cases, fixes can take over a month.
"In the rush toward IaaS adoption, many organizations overlook the shared responsibility model for the cloud and assume that security is taken care of completely by the cloud provider," said Rajiv Gupta, senior vice president of Cloud Security at McAfee. "However, the security of what customers put in the cloud, most importantly sensitive data, is their responsibility."
Evaluating The Vendors That Have Your Data
With the shift to cloud services, it becomes even more important to evaluate your vendors that have your data. Many of these misconfigurations could be identified when you are evaluating a vendor before data is transferred. However, all too often, a business unit may start "evaluating" a vendor prior to procurement or InfoSec involvement. We are quick to blame the vendor, however, as Rajiv Gupta indicated, the onus is on the customer.
Compliance Plus gives you:
