Top Threat #11 to Cloud Computing: Cloud Storage Data Exfiltration

Written by the CSA Top Threats Working Group.

The CSA Top Threats to Cloud Computing Pandemic Eleven report aims to raise awareness of threats, vulnerabilities, and risks in the cloud. The latest report highlights the Pandemic Eleven top threats, in which the pandemic and the complexity of workloads, supply chains, and new technologies shifted the cloud security landscape.

This blog summarizes the last threat (of eleven) from the report: cloud storage data exfiltration. Learn more about threat #9 here and #10 here.

What is Cloud Storage Data Exfiltration?

Cloud storage data exfiltration is an incident involving sensitive, protected, or confidential information. These data may be released, viewed, stolen, or used by an individual outside of the organization’s operating environment. Data exfiltration may result from an exploited vulnerability or misconfiguration, or just poor security practice. It can involve the public release of any kind of information including personal health information, financial information, personally identifiable information, trade secrets, and intellectual property.

The victims of data exfiltration are not typically aware of the loss of data. They might be notified if it is part of the attacker’s goal, such as in a ransomware attack. In some cases, the data loss remains unknown or is discovered after a long time, making mitigations irrelevant.

How to Prevent Data Exfiltration

There are multiple venues to exfiltrate data. It can be due to human error or abuse, such as misconfiguration of a PaaS service. Storage objects may also expose sensitive data or files shared externally through personal cloud storage applications. It might also start with a phishing attack, manipulating an application or a service.

As organizations move toward the Zero Trust model, traditional organizational perimeters play a lesser role. Least privilege access and identity-based security controls should limit data exposure. It’s important to implement cloud posture management to comply with the CSP’s best practices or regulatory baselines and mechanisms for attack detection and data disaster recovery.

Business Impact

There are several implications of a data breach:

• Loss of intellectual property
• Loss of customers, stakeholders, partners, and employees’ trust could inhibit business conduct, investments, and purchases
• Regulatory actions such as financial fines or a process and business change demand
• Geopolitical implications
• Loss of employees’ trust in the organization’s ability to protect employee data

What Are the Key Takeaways?

Here are some key takeaways to consider:

1. Cloud storage requires a well-configured environment
2. Apply the CSP’s best practices guides, monitoring, and capabilities
3. Employee awareness training on cloud storage usage is required
4. Implement client-side encryption where appropriate
5. Classifying data can help in setting different controls and document the impact and recovery actions required

Example

In June of 2021, Facebook faced a massive lawsuit in Europe due to a breach of user data which happened in 2019. In this data leak, over 533 million user accounts were found posted for free download in a forum.

Learn more about this threat and the other 10 top threats in our Top Threats to Cloud Computing Pandemic Eleven publication.