Top Threat #3 to Cloud Computing: Misconfiguration and Inadequate Change Control

Written by the CSA Top Threats Working Group.

The CSA Top Threats to Cloud Computing Pandemic Eleven report aims to raise awareness of threats, vulnerabilities, and risks in the cloud. The latest report highlights the Pandemic Eleven top threats, in which the pandemic and the complexity of workloads, supply chains, and new technologies shifted the cloud security landscape.

This blog summarizes the third threat (of eleven) from the report. Learn more about threat #1 here and threat #2 here.

Misconfigurations Leading to Vulnerabilities

A lack of system knowledge or lack of understanding of security settings can result in misconfigurations. Some common misconfigurations are:

1. Unsecured data storage elements or containers
2. Excessive permissions
3. Default credentials and configuration settings that are left unchanged
4. Standard security controls that are disabled
5. Unrestricted access to posts and services
6. Unsecured secrets management
7. Poorly configured or lack of configuration validation

Inadequate Change Control in Cloud Environments

Inadequate change control in cloud environments can result in incorrect configurations and prevent misconfigurations from being remediated. Cloud environments and cloud computing methodologies differ from traditional information technology (IT) in ways that make changes more difficult to control.

Business Impact

The impact of a misconfiguration/inadequate change control can be severe depending on the nature of the misconfiguration/improper change and how quickly it is detected and mitigated. Following the guidance from the CCAK Study Guide, we see that impacts include: disclosure of data, loss of data, destruction of data, system performance, system outage, ransom demands, non-compliance and fines, lost revenue, reduction in stock price, and reputational impact.

What are the key takeaways?

1. Companies need to embrace available technologies that scan continuously for misconfigured resources to allow remediation of vulnerabilities in real-time.
2. Change management approaches must reflect the unceasing and dynamic nature of continuous business transformations and security challenges.

Example

In October 2021, Facebook-owned apps Facebook, Instagram, Whatsapp, and Oculus went offline. Misconfigured changes interrupted communication, which led to a cascading effect on how the data centers communicated, bringing services to a halt. This outage also impacted many of the internal tools and systems used in day-to-day operations, complicating the issue’s diagnosis and resolution.

Learn more about this threat and the other 10 top threats in our Top Threats to Cloud Computing Pandemic Eleven publication.