Cloud misconfigurations are by far the biggest threat to cloud security, according to the National Security Agency (NSA). The 2022 IBM Security X-Force Cloud Threat Landscape Report found that cloud vulnerabilities have grown a whopping 28% since last year, with a 200% increase in cloud accounts offered on the dark web in the same timeframe.

With vulnerabilities on the rise, the catastrophic impact of cloud breaches has made it clear that proper cloud security is of the utmost importance. And so the question arises: Are your organization’s misconfigured cloud resources being advertised to malicious hackers?

Cloud Misconfigurations Put Data at Risk

Cloud misconfigurations are vulnerabilities waiting to happen. Malicious attackers are always hunting for misconfigured cloud assets because they can be a doorway to the theft of location data, passwords, financial information, phone numbers, health records and other exploitable personal data. Threat actors may then leverage this data for phishing and other social engineering attacks.

These misconfigurations happen for all kinds of reasons. One cause is the failure to change default settings, which tend to be too open.

Another is configuration drift, where changes to various components are made ad hoc, without consistency across cloud assets and auditing to avoid disparities.

The sheer complexity of cloud-native platforms makes misconfigurations more common. These risks are further complicated by overstretched teams that don’t have the breadth of knowledge to find and fix the misconfigurations.

But one of the most common roots of cloud misconfiguration is a misunderstanding of who is responsible for securing cloud assets. That’s why it’s vital for your organization to understand the Shared Responsibility Model.

This model means that the cloud provider — Amazon Web Service (AWS), Microsoft Azure, Google Cloud Platform (GCP) or others — is responsible only for the cloud’s infrastructure. Their customers — you and your organization — are fully responsible for the security of your data, workloads, applications and all other assets that belong to your organization.

How can cloud assets be misconfigured? Let us count the ways.

Common Cloud Misconfiguration Types

In the broadest sense, most cloud misconfigurations are settings left in a state that’s favorable to the aims of malicious attackers. Here are the most common categories:

  1. Excessively permissive cloud access. IBM’s Threat Landscape Report found that in 99% of cases analyzed, cloud identities were excessively privileged.
  2. Unrestricted ports, both inbound and outbound.
  3. Secret-data management failures, such as passwords, encryption keys, API keys and admin credentials.
  4. Leaving open the ICMP (Internet Control Message Protocol).
  5. Disabled logging and monitoring.
  6. Unsecured backups.
  7. Non-validation of cloud security controls.
  8. Unblocked non-HTTPS/HTTP ports.
  9. Excessive potential access to containers, VMs and hosts.
  10. Dangling DNSs. This results from changing a subdomain name without removing the underlying CNAME entry, which may allow an attacker to register it.

How to Minimize Your Risk From Cloud Misconfigurations

Potential vulnerabilities from cloud misconfiguration never sleep. Cloud servers are always available — to legit users and malicious attackers. Every new cloud deployment increases the organization’s attack surface.

The following steps can help your organization actively defend against attackers seeking to exploit cloud misconfiguration:

  1. Implement your security configuration program at the build stage, uniting security and DevOps in a single team.
  2. Make sure you hire and/or develop the wide range of skills needed to configure a dynamic cloud environment. Cloud security skills include DevOps experience, automation, networking and internet protocols knowledge, security engineering knowledge, authentication and security protocols knowledge, and others.
  3. Apply the Principle of Least Privilege (PoLP) for both machines and humans for access to all systems.
  4. Grant the bare minimum permissions for admins to perform their specific tasks, for no longer than necessary.
  5. Regularly audit for the validation of current permissions.
  6. Maintain visibility through proper monitoring. For example, make sure the DevOps team can access the full stack. They don’t need admin privileges, just reader or viewer privileges so they can see what’s going on.
  7. Don’t rely entirely on your cloud provider’s monitoring solution. Embrace monitoring that can be used across all your hybrid and multi-cloud environments.
  8. Understand the Shared Security Responsibility model and configure it accordingly. Do not rely on your cloud provider to secure your data, applications and other assets.

Above all, remember that properly configuring the settings present in complex and hybrid cloud environments is a journey, not a destination. Keep auditing. Maintain visibility. And get the staff and expertise on board that you need to manage this complex and crucial responsibility.

More from Cloud Security

The Importance of Modern-Day Data Security Platforms

Data is the backbone of businesses and companies everywhere. Data can range from intellectual property to critical business plans to personal health information or even money itself. At the end of the day, businesses are looking to grow revenue, innovate, and operationalize but to do that, they must ensure that they leverage their data first because of how important and valuable it is to their organization. No matter the industry, the need to protect sensitive and personal data should be…

Cybersecurity in the Next-Generation Space Age, Pt. 4: New Space Future Development and Challenges

View Part 1, Introduction to New Space, Part 2, Cybersecurity Threats in New Space, and Part 3, Securing the New Space, in this series. After the previous three parts of this series, we ascertain that the technological evolution of New Space ventures expanded the threats that targeted the space system components. These threats could be countered by various cybersecurity measures. However, the New Space has brought about a significant shift in the industry. This wave of innovation is reshaping the future…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

How Posture Management Prevents Catastrophic Cloud Breaches

We've all heard about catastrophic cloud breaches. But for every cyberattack reported in the news, many more may never reach the public eye. Perhaps worst of all, a large number of the offending vulnerabilities might have been avoided entirely through proper cloud configuration. Many big cloud security catastrophes often result from what appear to be tiny lapses. For example, the famous 2019 Capital One breach was traced to a misconfigured application firewall. Could a proper configuration have prevented that breach?…