Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

8/14/2017
04:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Amazon Tackles Security of Data in S3 Storage

Amazon Macie is a new security service built to protect AWS S3 data from accidental leaks and breaches.

Amazon today announced a new security service built to identify, classify, and protect sensitive data stored in AWS from leaks, breaches, and unauthorized access, with Amazon Simple Storage Service (S3) being the initial data store.

S3 appeals to organizations due to its simplicity: It's easy for users to sort their software and services data into "buckets" in the cloud. But the catch is that it's equally easy for users to misconfigure permissions and leave data exposed, as evidenced in high-profile data leaks affecting Verizon, the WWE, Republican National Committee, and Scottrade earlier this year.

Back in June, millions of voter records were leaked from an unsecured AWS S3 bucket storage account owned by Deep Root Analytics, which performed work on behalf of the Republican National Committee. Permissions had been set to public instead of private, making data files publicly accessible; in some cases, the records could also be downloaded.

One month later, a data leak at Dow Jones & Co. exposed the personal data of millions of customers after S3 settings had been configured to let any AWS Authenticated User download data using the bucket's URL. "Authenticated user" means anyone who has a free AWS account, meaning the data was accessible by more than one million people.

Amazon's new Macie service was not created in response to this year's S3 leaks, but could help address similar incidents by alerting security teams to events like misconfigured bucket permissions, which led to the Deep Root Analytics leak.

The service finds and classifies data stored in S3, gives each data object a business value, and monitors for suspicious activity based on user authentications to data, times of access, and data access locations, according to Amazon.

Macie runs an engine to specifically detect common sources of personally identifiable information (PII) or sensitive personal information (SP), Amazon's Tara Walker said in a blog post on the news. It also checks events in AWS CloudTrail for PUT requests in S3 buckets to detect and classify new information. Amazon's new service also uses machine learning algorithms and natural language processing to automatically classify data objects by file and content type. It shows how data objects are classified and highlights data based on how critical it is for business use, personal use, and compliance.

Data is assigned a risk level ranging from 1 (lowest risk) to 10 (highest risk). Its dashboard groups data into high-risk S3 objects (those with risk levels 8-10), total event occurrences since Macie was enabled, and total user sessions. Users can define and customize automated remediation actions, such as triggering password reset policies, based on activity.

After it sets a baseline for the organization's sensitive data, it monitors for activity that could indicate risky behavior.

Users are alerted of suspicious behavior that could put information at risk; for example, if large quantities of source code are downloaded by a user account that doesn't usually access the data. The same would happen if there were sudden changes in permissions of Amazon S3 buckets, or if API keys were uploaded into source code.

"By using machine learning to understand the content and user behavior of each organization, Amazon Macie can cut through huge volumes of data with better visibility and more accurate alerts, allowing customers to focus on securing their sensitive information instead of wasting time trying to find it," AWS CISO Stephen Schmidt said in a statement.

Macie can send findings to Amazon CloudWatch Events and support API endpoints through AWS SDK later this year so it can integrate with third-party tools. Planned integrations include providers like Palo Alto Networks, Trend Micro, and Splunk.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
UdyRegan
50%
50%
UdyRegan,
User Rank: Apprentice
7/31/2018 | 12:03:25 AM
Re: Introspective
I truly feel that the difficulty of all this online security will be the consumer themselves. I'm pretty sure that some of them will think that they know better and try to reconfigure their own security settings somehow. And then when there's a breach, they'll just up and blame the provider for not doing more to protect them. And too bad for them, because as a service provider, that's the onus they take upon themselves when they offer such services! 
cybersavior
50%
50%
cybersavior,
User Rank: Strategist
9/19/2017 | 11:32:49 AM
Introspective
The underlying reason that Amazon was motivated to author "Macie" is very telling.  Fundamentally, organizations don't maintain a good accounting of where their data is, how it is tagged/labeled nor who can acccess it (or derived works from it).
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7914
PUBLISHED: 2020-02-21
btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag.
CVE-2016-4606
PUBLISHED: 2020-02-21
Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
CVE-2020-5243
PUBLISHED: 2020-02-21
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent hea...
CVE-2019-14688
PUBLISHED: 2020-02-20
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial produc...
CVE-2019-19694
PUBLISHED: 2020-02-20
The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor could manipulate a key file at a certain time during the system startup process to disable the product's malware protection functions or the ...