Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cloud Security

Inside IaaS Security Challenges for Enterprises

Infrastructure-as-a-service can provide an attractive option for businesses, but approaching security wrong can come with a cost all its own.

Infrastructure-as-a-service can provide an attractive option for businesses, but approaching security wrong can come with a cost all its own.

This was underscored by a recent investigation by Symantec, which found that incorrectly configured access permissions allowed open access to a treasure trove of sensitive information stored in the cloud. According to Symantec, researchers were able to identify more than 16,000 cloud domains by enumerating domain prefixes with words from a dictionary. Of the domains they discovered, 0.3 percent had guessable folder structures that could be read by anyone and that led to more than 11,000 publicly accessible files containing everything from user names to credit card transaction logs.

As part of its experiment, Symantec used seven common directory names: backup, backups, archive, logs, database, databases and Vhds.

“Not all of the accessible data was sensitive, but some of it definitely was,” according to a whitepaper from Symantec entitled ‘Mistakes in the IaaS cloud could put your data at risk’, available here. “For example, during our research, we found an account belonging to a payment-processing company. The firm’s publicly accessible resources list contained many “bacpac” files, which are database backup files. Such files are goldmines for attackers, as they may contain plenty of sensitive information. In this case, this database contained user names, passwords, credit card transaction logs with the last four numbers of each card, email addresses, and other account details.”

What Symantec’s report emphasizes is a critical message – that responsibility for implementing IaaS technical security controls lies primarily with the cloud user, Jim Reavis, CEO of the Cloud Security Alliance (CSA), told SecurityWeek.

“We encourage cloud users to take advantage of cloud providers’ vetted VM templates and hardening guidelines,” he said. “Further, cloud users should make efforts to deploy a greater amount of encryption with segregated key management, strong authentication, robust change management processes and other best practices CSA has outlined to limit privileged access. As we saw in last year’s ‘iCloud Starlet‘ breach, attackers will most often go after the end points and cloud users as the path of least resistance rather than attacking cloud providers directly.”

Whereas software-as-a-service (SaaS) offerings provide defined API access, IaaS leaves most of the configuration and patching to the customer, explained Candid Wueest, principal threat researcher with Symantec’s Security Response team.

“Think of SaaS a WordPress-type of service, where patching and other maintenance is done by the provider,” he said. “Conversely, IaaS is akin to starting your own WordPress company, so you need the infrastructure to make it happen. The main discussion points [between vendors and customers] however, are the same: privacy, availability and compatibility or integration points.”

Advertisement. Scroll to continue reading.

The majority of vulnerabilities in the cloud today occur because of misconfigurations made by the customer, he added. Another common mistake is the accidental publishing of access tokens that can be used by attackers, he noted. To deal with these issues, organizations should consider two-factor authentication, encryption key management, logging and governance to secure cloud resources, he said.

Symantec also recommended including cloud IP addresses in vulnerability management processes and performing audits on any services that are provided through the cloud.

“When it comes to information protection for the cloud, organizations must understand where our critical data lies and who can access it, and then protect from incoming attacks,” said Wueest. “IT should insist on tools like data loss prevention, which can provide greater control and visibility over the sharing of confidential data wherever its used, as well as take direct action on policy violations.” 

Written By

Marketing professional with a background in journalism and a focus on IT security.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

CISO Conversations

SecurityWeek talks to Billy Spears, CISO at Teradata (a multi-cloud analytics provider), and Lea Kissner, CISO at cloud security firm Lacework.

Cloud Security

Cloud security researcher warns that stolen Microsoft signing key was more powerful and not limited to Outlook.com and Exchange Online.

CISO Strategy

Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

Cloud Security

Microsoft and Proofpoint are warning organizations that use cloud services about a recent consent phishing attack that abused Microsoft’s ‘verified publisher’ status.