Some companies will bury their head in the sand, attempting to ignore responsible, private disclosures of data leaks, while others will act rapidly when their information -- and reputation -- is at stake.
The surge in adoption of cloud-based technologies and Infrastructure-as-a-Service (IaaS) has added a new facet to cyberthreats -- the loss of information caused by misconfigurations and weak credentials in the public cloud space.
According to new research released Tuesday and conducted by cybersecurity firm McAfee, titled, "Cloud-Native: The Infrastructure-as-a-Service Adoption and Risk," the majority of IaaS misconfigurations are going unnoticed.
Indeed, only one percent of IaaS issues are reported, which may suggest there are countless companies across the globe that are unwittingly leaking data.
1,000 IT professionals were surveyed across 11 countries, and cloud usage data from over 30 million McAfee Mvision cloud users was aggregated to compile the report, which also says companies believe they average 37 IaaS misconfiguration issues per month when in reality this number can reach 3,500.
In total, 90 percent of respondents said they had come across security issues with IaaS, but only 26 percent said they were equipped to deal with misconfiguration audits -- and this lack of visibility into their cloud usage may be contributing to an increased data breach risk.
According to McAfee, IaaS-based data loss incidents triggered by data loss prevention (DLP) rules have increased by 248 percent year-over-year. As an example, the report says 42 percent of storage objects measured with recorded DLP incidents were misconfigured.
The report says that the top ten most commonly-misconfigured settings in AWS, the most popular IaaS provider for enterprise firms alongside Microsoft Azure, are as below:
- EBS Data Encryption
- Unrestricted Outbound Access
- EC2 Security Group Port Config
- Provisioning Access to Resources using IAM Roles
- Unrestricted Access to Non-Http/Https ports
- Unrestricted Inbound Access on Uncommon Ports
- Unused Security Groups
- Unrestricted ICMP Access
- EC2 Security Group Inbound Access Configuration
- EC2 Instance Belongs to a VPC
Close to a quarter of survey respondents admitted it can take longer than 24 hours to correct reported misconfigurations, and in some serious cases, fixes can take over a month.
"In the rush toward IaaS adoption, many organizations overlook the shared responsibility model for the cloud and assume that security is taken care of completely by the cloud provider," said Rajiv Gupta, senior vice president of Cloud Security at McAfee. "However, the security of what customers put in the cloud, most importantly sensitive data, is their responsibility."
According to research agency Gartner, the worldwide public cloud services market is expected to grow by 17.5 percent over 2019, reaching $214.3 billion. The IaaS segment is predicted to experience the strongest and quickest growth, climbing 27.5 percent to be worth $38.9 billion, up from $30.5 billion in 2018.
Previous and related coverage
- A data breach forced this family to move home and change their names
- Your business hit by a data breach? Expect a bill of $3.92 million
- 700,000 Choice Hotels records leaked in data breach, ransom demanded
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0