Accurics: Configuration errors are threat to cloud security

By Paddy Smith
A new report from Accurics says cloud security is threatened by poor configuration that leaves data exposed...

Poor configuration of cloud implementations poses a security threat, potentially leaving sensitive data exposed to public-facing servers.

That’s according to research from infrastructure-as-code provider Accurics, which scanned more than 1,800 security policies to come to its conclusion.

What are common cloud configuration errors?

The biggest problem, Accurics found, was default security settings. It’s vital to change these to prevent simple hacks, similar to hacking into someone’s router using the factory login details. Yet developers had either forgotten to override the default settings or made changes in the configuration that would leave the infrastructure vulnerable to attack.

What does the Accurics report recommend for cloud security?

The report recommends better training for developers in cloud infrastructure security, particularly where it is automated (via infrastructure as code, IaC). Automation is more efficient but does less to mitigate risk because the scripts cannot foresee every eventuality in every business.

Is it easy to fix?

Not at all. The average time taken to remedy cloud configuration errors, researchers found, was 25 days, and went up to 149 days. The report noted that the more critical the part of the infrastructure was, the longer it tended to take to fix. On top of that, scale played a part, with attackers able to exploit the advantages of hyperscale to their own ends. Om Moolchandani, chief technology officer at Accurics, said, ““The benefit of cloud is the ability to configure at scale and, unfortunately, that works to the attackers’ advantage as well.”

Are there other cloud security risks?

The report also identified ‘drift’, a phenomenon where adjusting the infrastructure security caused knock-on effects elsewhere in the security protocol. These were frequently unnoticed for long periods of time, as much as five years. It also flagged a security issue with Kubernetes container software, where access controls were misconfigured, leaving attack surfaces open.


Featured Articles

ESG needs a rethink: Technology holds the key

Sunil Rana, Founder and CEO of Vyzrd, the AI powered analytics platform, says discourse around ESG must change for integration and to gain traction

Klick Health: keeping transformation efforts consistent

Kreshnik Mati, Vice President, Technology at Klick Health joined TECH LIVE LONDON to discuss the importance of consistency in change management

Deepak Paramanand on ethical artificial intelligence

Deepak Paramanand, Executive Director of AI Research and Product Management at JP Morgan joined TECH LIVE LONDON to discuss ethical AI

How Red Bull & Oracle are already winning with data

Data & Data Analytics

Exec Q&A: Alex Cruz-Farmer, Cisco ThousandEyes

Enterprise IT

Cloud & 5G - Day 2 highlights from the in-person stage

Cloud & Cybersecurity