Researchers Play Leading Role in Detecting Cloud Misconfiguration

A new report finds 62% of cloud misconfiguration incidents are reported by independent researchers before criminals can find them.

Cloud misconfiguration problems have plagued security teams for years, with reports of data exposure regularly making headlines. While cases have seemingly declined, the problem persists, as indicated by analysis of misconfiguration events that took place over the past year.
Rapid7 researchers identified 121 publicly reported cases of data exposure in 2020 that were directly caused by a misconfiguration in the affected businesss cloud environment. Most (62%) of these instances were found and reported by independent researchers, and not criminals, but the 2021 Cloud Misconfigurations Report warns there are likely more cases still undiscovered.
The extent of researcher involvement stood out to Bob Rudis, chief data scientist at Rapid7 and author of the report. I just didnt realize before the volume of researchers going out there and proactively trying to identify these things, hopefully before attackers do.
On average, researchers report 10 disclosed incidents per month across 15 industries. Most of these incidents were found, disclosed, and remediated within the same month because they were discovered by people seeking out poorly secured services. Nearly half didnt specify the service; however, misconfigured permissions on Amazon Web Services buckets and Internet-facing Elasticsearch servers made up 25% and 21% of reported
data exposures
, respectively.
Amazon and Elasticsearch have taken steps to improve the security of default settings in recent years, Rudis notes. By default, all AWS S3 buckets are private and can be accessed only by the people who are explicitly granted access to it. Its default encryption settings allow users to set the default encryption behavior for an S3 bucket so new objects are encrypted when stored.
[With] newer installations of Elasticsearch and newer setups of S3, you really have to go out of your way to say, Im going to make this available on the Internet to everybody, says Rudis.
However, older configurations of
AWS S3
or Elasticsearch can still put organizations at risk, he continues. Admins should use caution when making a new S3 bucket and creating a policy: If they use an old one, it wont have the same security configurations as newer versions of S3. He advises revisiting old configurations and settings to see if theres anything putting data at risk, especially if youve been operating in the cloud for a while and still have older policies in place.
[There are] lots of things to check — policies to see, if theyre decent or not, he says. I know its another thing you have to do, another task … but doing that can save you from being a headline.
Information, Professional, Healthcare at Highest Risk
Of the industries affected by data exposure, the most represented are Information, Professional, Healthcare, and Entertainment. A range of 14 information types were reported as exposed; the most notable were datasets involving credentials, personal financial information, and personal health information, the
researchers report
. The median data exposure was 10 million records, though one incident led to the exposure of more than 20 billion records, they note.
Financial institutions usually fall toward the top of industry breakdowns because there are so many, Rudis says, noting that their absence indicate the finance sector has a better handle on controlling what they put in the cloud and configuring things. He wasnt surprised to see the Information and Professional sectors among the top industries suffering from data exposures.
Their data is their oil — that is what they use; that is part and parcel of what makes them go, he explains. The sheer amount of data these businesses collect and organize makes it difficult to ensure its all properly protected.
Healthcares presence among the top industries is worrisome, especially because industry experts have long emphasized the importance of securing healthcare data and there are several regulations in place to protect it. But regulatory oversight is a bit burdensome across the board, says Rudis, and the number of requirements placed on healthcare organizations from a privacy perspective and data control perspective usually means information is left in the open.
It doesnt help that healthcare institutions lack the resources and staff other organizations have, making it a challenge to move to the cloud for cost savings. Rudis, who talks with some healthcare organizations regularly, says they are all woefully understaffed. … Between ransomware and COVID, its been crazy for them, especially those in smaller communities.
To avoid a cloud misconfiguration incident, Rudis urges organizations to avoid the set it and forget it mentality and adopt the habit of checking and rechecking security policies for potential gaps. While independent researchers are helping many businesses avoid potentially massive security breaches, it shouldnt fall on them to discover misconfigurations for everyone.
Double check everything youre doing and constantly check everything, he says. Dont rely on the researchers to do that for you.

Last News
▸ New threat discovered: Mobile phone ownership compromised. ◂ Discovered: 23/12/2024 Category: security	▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Researchers Play Leading Role in Detecting Cloud Misconfiguration