Organizations Fail to Implement Cloud Security Basics – And it Bites Them
While the early promises in the move to cloud computing promised to simplify cloud management and security, and in many ways these promises have been kept. However, in other ways, cloud environments have increased security complexity. In fact, according to a recent survey, 84% of security professionals report that their organizations struggle to maintain secure cloud configurations.
During the Black Hat USA 2019 conference, security firm Tripwire surveyed 150 attendees about their views toward enterprise cloud security.
The survey found respondents believe cloud environment complexity is hindering their ability to effectively manage security. In fact, 35% of respondents said it was very easy to accidently expose data publicly through the cloud and 40% said it was “somewhat easy.” About 25% said it was not easy.
History would prove this out. Unsecured clouds have accounted for millions of breached records. There have been plenty of examples this year, perhaps the most notorious being the Capital One breach that affected over 100 million. As independent journalist Brian Krebs reported, the exposed data included approximately 140,000 Social Security numbers and approximately 80,000 bank account numbers on U.S. consumers, and roughly 1 million Social Insurance Numbers for Canadian credit card customers.
Last year stories broke of military contractor files left online and unsecured. In 2017, Verizon exposed millions of customer records due to an unprotected S3 bucket. Dow Jones experienced a similar situation. And throughout 2016 and 2017 we saw numerous poorly configured cloud-based databases being breached.
The vast majority of those breaches were caused by cloud misconfigurations. According to Tripwire’s survey, 84% of respondents find it difficult to maintain secure configurations across cloud services, and 17% said it was “very difficult.”
The hybrid nature of enterprise cloud environments is also contributing to the complexity. Enterprises not only have applications and data within on-premise and cloud systems, they have various types of cloud services from multiple cloud services providers, whether public and private clouds, public cloud services, and software as a service and platform as a service cloud services. That’s a mouthful of services to write, let alone manage.
Interestingly, the Tripwire survey found that 77% of respondent organizations manage 10 percent or more of their workloads in the cloud. Only 13% are managing three-fourths of their organization’s workload in the cloud, and about half of respondents said that more than 50% of their organization’s workloads are in the cloud. There wasn’t information released about the size of respondent enterprises, so it is difficult to determine value of these specific findings. One could assume the percentage of cloud workloads would be a function of enterprise size, age, and type of business.
