Cloud

10/13/2017
09:30 AM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

10 Major Cloud Storage Security Slip-Ups (So Far) this Year

Accenture is the latest in a string of major companies to expose sensitive cloud data this year, following Verizon, Deloitte, and Dow Jones.
Previous
1 of 11
Next

(Image: Posteriori via Shutterstock)

(Image: Posteriori via Shutterstock)

One of many concerning security trends from 2017 is the accidental exposure of cloud data via misconfigured Simple Storage Service (S3) buckets from Amazon Web Services. This year has been marked with several data leaks from major organizations, most recently Accenture.

"While this incident is very unfortunate, it's not very surprising," says RedLock cofounder and CEO Varun Badhwar of the Accenture leak.

Research from RedLock CSI (Cloud Security Intelligence) shows 53% of businesses using cloud storage services like AWS S3 have inadvertently exposed one or more of the service to the public Internet, up from 40% earlier in May. Researchers also found 38% of businesses have experienced the potential compromise of an administrative account in their public cloud.

The trend underscores a dangerous problem common among businesses of all sizes, as well as the third parties with which they entrust sensitive information. Many don't take steps to properly configure their cloud storage accounts or don't take the time to verify the security practices of third-party firms. As a result, they compromise customers' data.

"While you can offshore or outsource tasks and functions, you can never outsource the risks," said Chris Pierson, chief security officer at Viewpost, after the exposure of voter data from the Republican National Committee (RNC) via third-party misconfiguration back in June.

"As such, every company that deals in sensitive or valuable data should have an information assurance program that risk rates their vendors, monitors them for security and other factors, and provides governance to the company regarding their third party and the risk appetite set by the company."

Here, in no particular order, we round up ten major AWS leaks from this year, affecting everyone from Chicago voters to US government employees with Top Secret security clearance.

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tradichel
50%
50%
tradichel,
User Rank: Apprentice
10/16/2017 | 6:02:25 PM
Fixing S3 Bucket Problems
In order to fix S3 bucket problems, companies need to think more holistically about why they are happening. I published a related article on Secplicity explaining what it is like to manage a cloud environment with many people deploying new software all the time. Companies need to automate software deployments, inventory the software, and invest in more security controls that make it hard to deploy out of date software or configuration changes that are not following best practices and company policies.
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Now about that mortgage refinance offer from Wells Fargo .....
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3937
PUBLISHED: 2018-08-14
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2018-3938
PUBLISHED: 2018-08-14
An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST r...
CVE-2018-12537
PUBLISHED: 2018-08-14
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
CVE-2018-12539
PUBLISHED: 2018-08-14
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows,...
CVE-2018-3615
PUBLISHED: 2018-08-14
Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.