Trend Micro Incorporated : What You Can Do to Mitigate Cloud Misconfigurations

Our data also showed a high frequency of Amazon Simple Storage Service (S3) rule violations. Still, it is necessary to examine the data further before fearing for the worst. For one, not all Amazon S3 buckets are supposed to be encrypted. In some instances, encryption is not needed. These are cases where the data needs to be served in clear text such as for public sites or data that needs to be openly accessed through an application.

While encryption can be done on a case-to-case basis, data classification cannot and should be done in all instances. What are you putting into the storage container? Should it be encrypted? It is necessary to always answer these questions. Since cloud security posture management (CSPM) technologies should not have access to your data (and neither should your cloud provider), it is up to your organization to determine the encryption level of your data. It is therefore a must for organizations to review whether they do conduct such assessments, as well as if they have visibility over what is happening within their cloud.

Overall, the high-severity misconfigurations we enumerated in our report can lead to significant consequences, mostly because of their potential for data breaches. Some of the consequences of data breach include reputational damage, data privacy law violations, and operational issues.

The worst-case scenario that a data breach can have for organizations is the loss of business. Customers and businesses expect the strongest security with respect to their data and intellectual property. If any of these are violated, organizations will likely face reputational damage.

The good thing about misconfigurations is that you can do something about them. What makes attacks that stem from a misconfiguration difficult to live down is how they could have been easily avoided had the misconfiguration been noticed in the first place. Nevertheless, we still recommend learning what you can do to mitigate cloud misconfigurations.

Automating security

Automation and visibility are the number one problem we see within our customer cloud environments today. While there is indeed talent in tech to handle safely moving to the cloud, there is also a shortage of employees. DevOps teams are building at record pace and releasing applications daily or hourly, but security teams cannot always keep up. One way they can do so is to automate and augment their work. Having software-defined infrastructure (SDI), infrastructure as code (IaC), and up-to-date templates and containers assist with respect to automation and augmentation.

Automating compliance

Building compliance into the automation cycle used by the organization should be considered a baseline measure. This is an important standard set by cloud providers. With regard to the cloud, security must go beyond various global standards to include those referenced by cloud providers, in addition to best practices for an organization's specific industry.

Upskilling the workforce

The cloud and DevOps are developing quickly. However, cybersecurity is not ingrained in students or future programmers. Programmers do not have an inherent security-driven focus when developing their work, so bugs that affect security happen constantly. IaC and SDI, as well as the integration of CSPM in the DevOps cycle, help with this challenge. In short, upskilling people can ensure security from the design phase. As the saying goes, "shifting left" is good, but "starting left" is better.

Overall, it is important to understand that the cloud is fallible. Its security is a responsibility shared by the cloud service provider (CSP) and the organization. Organizations should thus do their part and live up to their role in keeping their cloud environments secure.

This can be a daunting task, especially when organizations have had to quickly cope with the demands of a global pandemic. Still, security must be prioritized to avoid even heavier consequences and to build more confidence in cloud environments.