Misconfigured Cloud Services Pose High Security Risks for Organizations

Cloud security has become a significant issue as organizations increasingly move their workload to the cloud. Research into the safety of cloud-integrated workloads recently revealed that over 21,000 orchestration containers and application programming interfaces (APIs) were at risk, including popular applications such as Kubernetes, Marathon, RedHat OpenShift and Portainer. The worst security offenders discovered were 300 open administrator dashboards that did not require any means of authentication. This isn’t the first time that a misconfigured cloud has left organizations vulnerable to attacks. Some examples of cybersecurity incidents caused by a misconfigured cloud include the Alteryx breach, which exposed data on over 120 million households, and a recent incident in which misconfigured Google Groups settings left 9,600 organizations exposed.

The risks of cloud misconfiguration

Perhaps the most significant security consideration when it comes to a misconfigured cloud application is that it doesn’t take much technical knowledge to extract data or compromise an organization’s cloud assets. The worst cases of exposed data can often be attributed to simple human error rather than a concerted attack. For example, a recent security incident inadvertently exposed roughly 3.5 million records, which included user credentials, email addresses, Social Security numbers, and other confidential data. All of these records were easily available to anyone who had the desire to access them, without the need to use sophisticated tools or techniques. The nature of the data involved also meant that they could be used for malicious purposes or more complex attacks. Email addresses and Social Security numbers could be used to perform social engineering, while user credentials could be used to access even more accounts. In the case of containers or APIs, applications could be manipulated or even deleted, which could significantly affect an organization’s operations.

Configuration is a responsibility of the organization

Given that cloud services are offered by service providers that handle the hardware and back-end portions of the cloud, it’s easy to assume that they are also responsible for every aspect of security. The truth is that configuration is an aspect of the shared responsibility model of cloud security that often falls in the hands of the organization.

Businesses should not take cloud configuration lightly, nor should they assume that simply storing the data in the cloud makes it safe. Implementation of certain best practices can strengthen an organization’s cloud security and prevent their data from being publicly exposed:

Get to know your cloud. While added convenience is one of the main advantages of using cloud services, it doesn’t necessarily mean that implementing a cloud workload is a “plug and play” affair. A company’s IT staff should take the time to learn all the settings and permissions of its cloud service and take advantage of any integrated security features. While this might take some time and effort on the part of the IT staff, it is necessary for securing the platform.

Check and modify credentials and permissions. Businesses that are just starting out using the cloud for their operations might assume that default configurations are good enough to prevent their workloads from being compromised. However, default configurations are often very basic or even nonexistent. Organizations should thoroughly check their existing credentials and permissions to confirm that access to their workloads is limited to those who should have it. Businesses should consider setting up multi-factor authentication for credentials to provide an extra layer of security.

Regularly audit cloud assets to check for signs of misconfiguration. A common mistake organizations make when it comes to their cloud assets is assuming that a properly configured cloud will always remain so. With the number of users accessing the cloud, any change could expose stored assets. For example, an employee may be able to create a new folder that doesn't require security credentials. The organization may not notice misconfigured settings without proper auditing and monitoring.

Implement security measures such as logging and network segmentation. The large number of users accessing the cloud can make managing it difficult. Many cloud service providers offer logging tools that can help organizations see what is happening in the cloud. These tools can also alert IT staff of any unauthorized access or malicious attack attempts.

Implementing strict user access minimizes the chance of exposed assets and compromised data. For example, human resource personnel should not have access to accounting data, nor should sales teams have access to IT logs. Businesses should consider network segmentation when configuring their cloud, as this minimizes the risks in case they become targets of attacks.

Choose the right security solutions when it comes to cloud security. Businesses looking to maximize their cloud security can also look into solutions that can bolster the integrated security features offered by cloud service providers. The best security solutions are those that can offer a complete package of features that include threat detection, network intrusion prevention, and security management.

The Trend Micro™ Deep Security™ for Cloud solution can provide proactive detection and prevention of threats, while Hybrid Cloud Security offers optimal security for hybrid environments that incorporate physical, virtual, and cloud workloads. 

Businesses can also consider Trend Micro Deep Security as a Service, which is a dedicated protection system optimized for AWS, Azure, and VMware. It can help an organization’s IT department by securing servers without the need for any installations. It allows businesses to implement new upgrades without any downtime, and can instantly connect to the cloud and data center resources for proactive security measures.