Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
IoT Bug Grants Access to Home Video Surveillance
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/8/2019 | 7:04:31 PM
Re: more of the same
@RyanSepe: I have heard from highly regulated entities that they have experiences with cloud vendors with 360-degree auditing -- i.e., that in addition to auditing the vendor, the vendor audits the customer to ensure that they are doing what they need to do to be secure while using their platform. A great example of teamwork -- and it would be a great way to prevent the kind of brand damage AWS has suffered from this kind of thing.

Of course, one of AWS's biggest selling points is its accessibility for even the smallest of businesses/entities -- so that's pretty impractical (at least, at the personalized level) for AWS for its smaller clients.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/2/2019 | 2:52:32 PM
Re: more of the same
Agree 100%. I think its a tragic principle of a lack of education. By that I mean, Amazon does a great job to ensure that they configure their product to be a secure iteration by default. (Not overly stringent, but gets the job done) Unfortunately, it is then handed off to a NON-Amazon entity (corporate IT entity) who may not be overly familiar with how the S3 bucket is set up. By default this will restrict them from performing the function they need to support the business, so what will they do? They will remove the safeguards to allow them to do said function. In the process, removing any secure configuration they may have had. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
12/31/2018 | 10:46:46 PM
more of the same
Geezalou, another freakin' gross misconfiguration of S3-bucket access. This has been a huge trend over the past couple of years (despite the fact that the default settings tend to be more secure) -- to the point that AWS has had to change their UI a little.

I expect the trend to continue. Stupidity doesn't just end.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15820
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
CVE-2020-15821
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.
CVE-2020-15823
PUBLISHED: 2020-08-08
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
CVE-2020-15824
PUBLISHED: 2020-08-08
In JetBrains Kotlin before 1.4.0, there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
CVE-2020-15825
PUBLISHED: 2020-08-08
In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.