Cloud Security Vulnerabilities Present in 93% of Deployments: Study

Abhisheik Shandilya

5 months ago

Cloud Security is one of the most overlooked aspects when enterprises move to the Cloud. Although industry experts have often tried to engage people regarding the issue, it largely flies under the radar. It takes some huge breach for the debate around Cloud Security to surface, and then it is relegated to the ‘to-do later’ pile once again. An industry report highlights the same issues concerning Cloud breaches.

How Safe Are Cloud Deployments?

A recent report by Cloud Security firm Accurics brings out startling revelations regarding Cloud deployments. The study claims that misconfigured cloud storage services were commonplace in 93 percent of the cloud deployments analyzed. The State of DevSecOps Report by Accurics also revealed that most of the Cloud deployments had at least one network exposure where a security group was left wide open. The report further states that as more organizations embrace the path of digitalization, the number of breaches are only going to increase.

According to the report, the two aforementioned issues “have already contributed to more than 200 breaches over the past two years.” Cloud-related breaches should still be fresh in public memory as it was only in July 2019 when the infamous Capital One breach hit the headlines. The Capital One breach was responsible for more than 100 million US citizens and over 6 million people Canadians being impacted. The data leak included 140,000 Social Security numbers and 80,000 bank account numbers of US citizens and over a million Canadian Social Insurance numbers.

Here’s what Om Moolchandani, co-founder and CTO at Accurics, stated, “While the adoption of cloud native infrastructure such as containers, serverless, and servicemesh is fueling innovation, misconfigurations are becoming commonplace and creating serious risk exposure for organizations. As cloud infrastructure becomes increasingly programmable, we believe that the most effective defense is to codify security into development pipelines and enforce it throughout the lifecycle of the infrastructure. The receptiveness of the developer community toward assuming more security responsibility has been encouraging and a step in the right direction.”

Cloud Security Issues Faced by Deployments

The study found that a large number of major Cloud breaches could be traced back to hardcoded private keys, present in around 72 percent of Cloud deployments. The study’s findings stated that one out of two Cloud deployments had unprotected credentials stored in container configuration files, and these keys and credentials could give attackers access to sensitive cloud resources.

The study by Accurics categorized Cloud security issues into three categories:

Hardcoded Keys — Hardcoded Keys often have high privileges. If these are breached, it can expose all of the resources associated with them.
Overly Permissive Identity and Access Management (IAM) Policies — Although easier IAM policies often seem warranted, they might come with unpleasant results. The report states that most organizations failed to assess the downstream impact of the elevated privileges on other resources that were using the policies.
Exposures Due To Misconfigured Routing Rules — According to the report, sensitive resources like databases were hosted in private subnets. These private subnets were exposed to the internet because of the specific routes of communication created between the public and private subnets. This finding was consistent for 100 percent of the Cloud deployments analyzed by Accurics.

Keeping aforementioned facts and findings in mind, it becomes crystal clear that Cloud security is no matter to be ignored. The study concurs on the same and calls for codification of security into developmental pipelines of Cloud infrastructure, while ensuring that the measures are enforced throughout the life-cycle.