99 Percent Of All Misconfigurations In The Public Cloud Go Unreported

Charlie Osborne at ZDNet wrote: "Today's data breaches often seem to be caused not just by malware infections or external threat actors, but human error, insiders with an ax to grind, and simple security failures.

Some companies will bury their head in the sand, attempting to ignore responsible, private disclosures of data leaks, while others will act rapidly when their information -- and reputation -- is at stake.

The surge in adoption of cloud-based technologies and Infrastructure-as-a-Service (IaaS) has added a new facet to cyberthreats -- the loss of information caused by misconfigurations and weak credentials in the public cloud space.

According to new research released last week and conducted by cybersecurity firm McAfee, titled, "Cloud-Native: The Infrastructure-as-a-Service Adoption and Risk," the majority of IaaS misconfigurations are going unnoticed. 1,000 IT professionals were surveyed across 11 countries, and cloud usage data from over 30 million McAfee Mvision cloud users was aggregated to compile the report, which also says companies believe they average 37 IaaS misconfiguration issues per month when in reality this number can reach 3,500."

Just One Percent Of IaaS Issues Are Reported

That means that there are likely countless organizations worldwide that are leaking data but are unaware that they do. In total, 90 percent of respondents said they had come across security issues with IaaS, but only 26 percent said they were equipped to deal with misconfiguration audits -- and this lack of visibility into their cloud usage may be contributing to an increased data breach risk.

According to McAfee, IaaS-based data loss incidents triggered by data loss prevention (DLP) rules have increased by 248 percent year-over-year. As an example, the report says 42 percent of storage objects measured with recorded DLP incidents were misconfigured.

• EBS Data Encryption
• Unrestricted Outbound Access
• EC2 Security Group Port Config
• Provisioning Access to Resources using IAM Roles
• Unrestricted Access to Non-Http/Https ports
• Unrestricted Inbound Access on Uncommon Ports
• Unused Security Groups
• Unrestricted ICMP Access
• EC2 Security Group Inbound Access Configuration
• EC2 Instance Belongs to a VPC

Close to a quarter of survey respondents admitted it can take longer than 24 hours to correct reported misconfigurations, and in some serious cases, fixes can take over a month.

"In the rush toward IaaS adoption, many organizations overlook the shared responsibility model for the cloud and assume that security is taken care of completely by the cloud provider," said Rajiv Gupta, senior vice president of Cloud Security at McAfee. "However, the security of what customers put in the cloud, most importantly sensitive data, is their responsibility."

Evaluating The Vendors That Have Your Data

With the shift to cloud services, it becomes even more important to evaluate your vendors that have your data.  Many of these misconfigurations could be identified when you are evaluating a vendor before data is transferred.  However, all too often, a business unit may start "evaluating" a vendor prior to procurement or InfoSec involvement.  We are quick to blame the vendor, however, as Rajiv Gupta indicated, the onus is on the customer.

Centralized Vendor Risk Management

KCM’s Vendor Risk Management module helps you centralize your process to manage your third-party vendor security risk requirements. With a single pane of glass view, you get continuous visibility into your vendors’ controls and evidence libraries and can keep track of their compliance requirements, services they provide, and what data they have access to in one centralized repository

In KCM's vendor risk management module, we include the CSA CAIQ (Cloud Security Alliance Consensus Assessments Initiative Questionnaire) as a template.  The CSA CAIQ is for cloud users to assess the capabilities of a cloud service vendors.

KCM includes four modules: Compliance, Policy, Risk and Vendor Risk.

Now, you can effectively and efficiently manage risk and compliance within your organization and across your third-party vendors, while gaining insight into gaps within your security program.

The new KCM GRC platform helps you get your audits done in half the time, is easy to use, and is surprisingly affordable. No more: "UGH, is it that time again!"

KCM GRC simplifies the challenges of managing your compliance, risk, and audit projects, enables you to efficiently manage GRC initiatives, and understand at a glance what items need to be addressed.

Get a first look at the new Vendor Risk Management module.

Watch an 8-minute on-demand product demonstration for a first look at the new Vendor Risk Management module. See how you can simplify the challenges of managing your compliance requirements and ease your burden when it’s time for risk assessments and audits.

• Keep track of third-party vendor compliance requirements, services they provide, and what data they have access to in one centralized repository.
• Vet, manage, and monitor your third-party vendors’ security risk requirements.
• Streamline vendor assessments with automated workflows and campaigns
• Ensure standard and consistent assessments with pre-built managed vendor assessment templates.

See how you can get audits done in half the time at half the cost!

Don't like to click on redirected links? Copy & Paste this link into your browser
https://info..com/demo-kcm-grc-vendor-risk

Original Story at: https://www.zdnet.com/article/99-percent-of-all-misconfiguration-in-the-public-cloud-go-unreported/

Comments are closed.