Accurics: Configuration errors are threat to cloud security

By Paddy Smith
A new report from Accurics says cloud security is threatened by poor configuration that leaves data exposed...

Poor configuration of cloud implementations poses a security threat, potentially leaving sensitive data exposed to public-facing servers.

That’s according to research from infrastructure-as-code provider Accurics, which scanned more than 1,800 security policies to come to its conclusion.

What are common cloud configuration errors?

The biggest problem, Accurics found, was default security settings. It’s vital to change these to prevent simple hacks, similar to hacking into someone’s router using the factory login details. Yet developers had either forgotten to override the default settings or made changes in the configuration that would leave the infrastructure vulnerable to attack.

What does the Accurics report recommend for cloud security?

The report recommends better training for developers in cloud infrastructure security, particularly where it is automated (via infrastructure as code, IaC). Automation is more efficient but does less to mitigate risk because the scripts cannot foresee every eventuality in every business.

Is it easy to fix?

Not at all. The average time taken to remedy cloud configuration errors, researchers found, was 25 days, and went up to 149 days. The report noted that the more critical the part of the infrastructure was, the longer it tended to take to fix. On top of that, scale played a part, with attackers able to exploit the advantages of hyperscale to their own ends. Om Moolchandani, chief technology officer at Accurics, said, ““The benefit of cloud is the ability to configure at scale and, unfortunately, that works to the attackers’ advantage as well.”

Are there other cloud security risks?

The report also identified ‘drift’, a phenomenon where adjusting the infrastructure security caused knock-on effects elsewhere in the security protocol. These were frequently unnoticed for long periods of time, as much as five years. It also flagged a security issue with Kubernetes container software, where access controls were misconfigured, leaving attack surfaces open.


Featured Articles

The cutting edge: Edge computing trends to watch in 2023

As the IoT has grown and the volume of data has increased, edge computing has become increasingly important. We look at the edge trends to watch this year

Shadow APIs pose serious threat to fintechs, report finds

A third of all financial services’ API traffic is going unmonitored, Imperva Threat Research has found, in what should be a concern for many businesses

IBM and NASA to research impact of climate change with AI

New IBM foundation model technology leverages NASA earth science data for geospatial intelligence

'Change is the new normal' Accenture cloud study finds

Cloud & Cybersecurity

Zurich selects AWS to help accelerate digital transformation

Digital Transformation

Technology can overcome public sector data privacy concerns

Data & Data Analytics