3 Common Cloud Security Mistakes

With a rising dependence on cloud, maintaining security in the cloud is  becoming more critical for organizations around the globe.

According to security researchers, here are three common cloud security threats and mistakes to avoid.

Cloud security threat 1: the AWS S3 bucket misconfiguration risk

You've probably seen the headlines, or tweets, about organizations leaving their critical data exposed to the world in their Amazon Web Services S3 buckets. 

Trend Micro researchers explain where many companies go wrong, as well as another cloud security issue to watch for in AWS:

"One of the consistent trends we saw in studying Amazon S3 buckets is that many organizations leave them world-writable—a misconfiguration that allows unauthorized users to write to the bucket.

Another issue we encountered were files classified as malicious that were being hosted on Amazon S3 buckets. This poses a problem for security filters since blocking the hostname of a malicious website that uses the path-style scheme will invariably block other non-malicious sites as well."

Cloud security threat 2: Kubernetes vulnerability

Kubernetes is an open-source container orchestration platform. It's used to manage container workloads, however, exposing these servers to the internet can increase risk:

"Kubernetes uses the API of its Kubeletes subcomponent to manage the containers in each node. In older Kubernetes iterations before version 1.10, Kubelet exposed the data port 10255 and the control port 10250. Both of these ports can be exploited. While the abuse of the control port is more apparent—for example, it can be used to install cryptocurrency miners—port 10255 can contain potentially sensitive information.

We found over 2,400 exposed etcd servers using Shodan, representing a mix of both Kubernetes and other software."

Cloud security threat 3: improper credential management

Since organizations are unable to physically secure a cloud system, credential usage is critical to maintaining security.

However, researchers find many organizations making the following cloud security missteps:

"A common mistake made by programmers is that they inadvertently leak credential information on public repositories like GitHub. Another issue we found is that many inexperienced programmers often follow misleading cloud tutorials, many of which encourage the hardcoding of credentials inside the code itself."

For more information on these cloud security threats, check out the new research from Trend Micro.