Attention to detail is crucial when maintaining cybersecurity within an organisation. Security controls must be consistent and robust and extend to every aspect of the system. However, it must be noted that adversaries only need to identify one or two vulnerabilities to breach an enterprise’s defences, making it clear why they continue to find ways to infiltrate systems.
This issue is particularly pronounced in cloud environments, where the vast amounts of data and numerous users interacting with it can create opportunities for misconfigurations. Malicious actors can exploit such lapses, leading to unauthorised access to sensitive information. These security oversights can result in significant financial losses, reputational harm, and other collateral damage if not addressed. Over the past year, several high-profile data breaches linked to insufficient enforcement of Multi-Factor Authentication (MFA) have cost companies tens of millions in ransomware payments and have exposed the personal information of over 100 million customers to the dark web.
Recent statistics from the Office of the Australian Information Commissioner (OAIC) indicate that the frequency of reported data breaches in the first half of 2024 reached its highest level since 2021. From January to June 2024, there were 527 breach notifications, reflecting a 9% increase compared to the latter half of 2023. While some of these breaches were significant in scale, their underlying causes are alarmingly typical.
According to the 2024 Elastic Global Threat Report from Elastic Security Labs, nearly 50% of the security failures in Microsoft Azure and Google Cloud environments stemmed from encryption and account misconfiguration issues. Many of these problems can be remedied with straightforward configuration adjustments. In contrast, others highlight the need for more rigorous policies and monitoring to prevent user actions that could inadvertently elevate the risk of successful attacks.
Google Cloud Platform (GCP) – Customer-Managed Encryption Keys (CMEK) for BigQuery
The primary risk of data exposure for organisations utilising Google Cloud Platform (GCP) arises from incorrectly configuring encryption in BigQuery, a cloud service designed for storing and searching data across various scenarios. Companies frequently rely on BigQuery to handle their most crucial datasets, particularly for tasks such as large-scale data analysis, report generation, and the integration of data into machine learning models. Due to its extensive usage and the sensitive information it manages, BigQuery is an appealing target for cyber attackers.
Most security lapses related to this service are associated with users operating BigQuery tables without implementing Customer-Managed Encryption Keys (CMEK). CMEK is essential because it allows organisations to maintain greater control over the encryption keys used within their cloud environment, tailored specifically to their datasets. Customers can use CMEK to decide when to rotate, destroy, or disable their encryption keys, which adds an additional layer of security and helps maintain the confidentiality of key materials beyond the control of cloud providers.
The first step to effectively secure data in GCP involves regulating access policies for BigQuery datasets to block anonymous or public access. To further minimise the risk of exposing these datasets, it’s essential to implement stringent organisational policies that require the use of CMEK across as many supported services as feasible.
Google Cloud Platform – Customer-Supplied Encryption Keys (CSEK) for Virtual Machines (VM)
The second most common security misconfiguration in Google Cloud Platform (GCP) relates to virtual machines (VMs), which are becoming increasingly vital in today’s computing infrastructure. As organisations increasingly migrate their workloads to the cloud, the popularity of VMs continues to rise due to their ability to scale resources flexibly and provide distinct environments for code development and testing.
Nonetheless, improper configurations in VM security and host policies can leave critical workloads vulnerable to various attacks, including unauthorised access. A prevalent oversight is the failure to enable Customer-Supplied Encryption Keys (CSEK), which accounts for nearly half of the security failures within GCP virtual machines. Like Customer-Managed Encryption Keys (CMEK), CSEKs are essential for ensuring data privacy, as they grant customers complete control over the encryption of their data.
Chief Information Security Officers (CISOs) must be diligent in their policies to mandate the use of CSEK and ensure that virtual machines are secured through regular patching, updates, and the implementation of features such as shielded VMs and disk encryption.
Amazon Web Services (AWS) – MFA Delete in Simple Storage System (S3)
Organisations often misconfigure the Simple Storage System (S3) component of Amazon Web Services (AWS). The SS3 is an AWS object storage service that lets users store and retrieve data. S3 is used for a myriad of applications, including backup and restore, disaster recovery, archiving, data lakes and big data analytics, hybrid cloud storage and content distribution.
Failure to enable MFA for delete privileges is one of the most common security lapses in S3 configuration, allowing bad actors to gain access to valid credentials to delete or modify content stored within the service. Many companies also overlook the configuration of S3 buckets to block public access, which leaves them vulnerable to unauthorised access.
Networking issues are the second most prevalent security failure in AWS environments after S3 misconfigurations. The primary issue is often the misconfiguration of ingress access to networks within AWS.
In these cases, the policies associated with resources may allow traffic from any IP address or port—both administrative and otherwise—into Virtual Private Cloud (VPC) networks. This can leave applications hosted on Amazon’s EC2 virtual servers vulnerable.
To safeguard against this, CISOs must implement strict controls on network access, limiting it to trusted IP addresses and necessary ports. This step is crucial in preventing threat actors from performing vulnerability scans and fingerprinting web servers, which could lead to unauthorised remote access breaches.
Microsoft Azure – Storage Account Misconfigurations
Similar to AWS S3, one of the most prevalent security misconfigurations in Microsoft Azure is associated with storage accounts. These accounts play a crucial role in many enterprises’ cloud infrastructures, offering scalable storage solutions for various types of data. Unlike Google Cloud Platform (GCP) and AWS, however, there isn’t a standout misconfiguration primarily responsible for exposing vulnerabilities in Azure.
Instead, attackers can gain unauthorised access by exploiting several frequently misconfigured settings within Azure. A major issue is the failure to activate infrastructure encryption for each storage account and the lack of restrictions on storage account access via private endpoints.
For this reason, CISOs managing Azure environments should prioritise the protection of sensitive data at rest by implementing an additional layer of encryption. This acts as a crucial safeguard against potential intrusions and data theft, especially if other security measures are compromised. Additionally, they should restrict access to Azure virtual networks, allowing only private and trusted endpoints.
Ultimately, these security oversights can be traced back to a lack of policy enforcement. Top cloud service providers offer the necessary tools to limit storage and network access and empower users to encrypt and decrypt their data. CISOs are responsible for prioritising safety over convenience and implementing the strictest policies possible for their platforms and users.