Why misconfiguration remains the biggest cloud security threat

What is misconfiguration?

Misconfiguration can broadly be interpreted as a failure to adequately apply restrictions on a service or system residing in the cloud. It occurs when applications are spun up into the cloud and new services are activated and can happen in various ways. There could be a failure to configure from day one, leaving systems with default settings or a failure to apply access restrictions and enforce the least privilege. Or perhaps unapproved changes were made in contravention of the security policy. Or systems were left publicly exposed to the internet – a common failing with object storage buckets.

The potential for misconfiguration is vast, but there are hotspots. Identity and entitlement access management due to the proliferation of identities within the cloud is a case in point, as each of the permissions for each of these has to be nailed down. Other areas include security group/firewall rules, whether logging has been disabled/enabled, encryption controls for data at rest and in transit. And there’s also the potential for orphaned resources which then fly under the security radar.

Current and future issues

The ramifications of misconfiguration can be devastating, with any data breach potentially providing a foothold into the cloud environment. This can lead to the harvesting of credentials which are then leaked or sold on and used for credential stuffing attacks, the automated injection of username/password pairs to website log-ins.

And it’s a problem is that is set to worsen because of the way the cloud is evolving. We’ve seen rapid migration to the cloud under the pandemic but also expansion leading to higher uptake of hybrid and multi-cloud environments. Using a number of different platforms can make it difficult to maintain visibility and because service provider offerings are platform-specific and few organisations have pan-cloud security, gaps can result, leaving the business exposed. Many also don’t have the internal expertise needed to manage and maintain these environments.

Mitigating misconfiguration

Keeping on top of configuration requires a multi-faceted approach. A priority is maintaining visibility of cloud assets, entities and identities and to do that you’ll need to consider if your Identity and Access Management (IAM) is fit for purpose and can right size privileges to ensure the appropriate level of access is assigned to cloud services.

You’ll also need to consider how you can maintain a unified approach to the configuration as your cloud footprint grows and ensure policies are applied across different computing environments ie hybrid and multi-cloud.

The need to continually spin up and make changes to services often on a daily basis means you’ll also need oversight of all APIs and interfaces, requiring some form of automation of cloud compliance.

Yet even with these advanced automation tools, you’ll need eyes-on to resolve issues. Having the expertise to manage, interpret and respond appropriately remains a real concern for cloud teams.