Vulnerability Hiding in Plain Sight – InApps Technology 2022

In today’s technology-driven landscape, most companies have at least some, if not all, workloads on the cloud. And unlike on-premises networks, these cloud environments lack secure outer perimeters and specific off times.

Cloud networks are always on and always available. While convenient, this also means hackers can access them at any time. So, any vulnerabilities in these networks, such as cloud misconfigurations, can leave your organization open to security threats.

In this article, we examine the different types of cloud misconfiguration and why they occur. Then we explore what your team can do to prevent misconfigurations and ensure the safety of your data and your business interests.

What Is Cloud Misconfiguration?

According to the NSA, misconfiguration is the most common cloud security vulnerability. Cloud misconfigurations typically occur when cloud resources have not been constructed properly, leaving your systems vulnerable to attack.

Cloud environment misconfigurations can cause system outages, unwanted downtime or security risks. Causes can include overly complex environments, insufficient security practice knowledge and human error due to manual processes.

Types of Cloud Misconfigurations

The misconfiguration of cloud environments and resources can encompass a wide range of security issues.

Let’s take a look at the two most common misconfiguration types: insufficient access controls and permissive network access.

Insufficient Access Controls on Resources

The default permissions on the cloud typically start out with minimal barriers. This means everyone can access everything until the developer or system admin implements an access control. Therefore, it is crucial that you remember to set these controls right off the bat.

Another scenario is when your developer decides to set everything as open access while configuring your applications. While this makes their job easier during the process, if they do not go back to reimplement the access controls, your system will face a higher risk of data leakage.

Permissive Network Access

Just like access controls, when your team members establish networks or new servers, they may apply relatively permissive port access and routes while configuring applications.

The key is to ensure that only the intended external-facing ports are exposed, thus reducing the communication options between resources. This removes many attack vectors that malicious parties can use.

Risks Associated with Cloud Misconfigurations

So now we know what misconfigurations are. Why should we care?

Cloud misconfigurations can pose various risks to your company’s security and your ability to serve your customers. Depending on the type of misconfiguration, this risk can range from performance or reliability issues to significant security risks.

The two most common risks are sensitive data leaks and service disruption.

Leaking of Sensitive Data

Many access control misconfigurations can expose sensitive data or leave valuable files at risk of being stolen. Allowing attackers to read data from your databases or retrieve files from cloud storage puts your company at risk of corporate espionage, exposes users’ personal information and enables malicious actors to delete critical data.

Disruption of Services

If attackers gain access to your network or servers, they can potentially disrupt your services.

This disruption can include ransomware attacks. Hackers can encrypt your files or servers, delete resources or even use your servers to send spam or mine bitcoins illicitly.

Additionally, incorrectly configured servers, networks, or containers could prevent scaling correctly under load or hinder recovery from a site disaster. This can cause outages for your users and force you to overpay for environments.

How Cloud Misconfigurations Occur

As IT professionals, we do not intentionally set out to misconfigure resources or set up environments in a way that will cause problems later. Most misconfigurations occur due to human error, mainly due to factors like overly complex infrastructure or insufficient understanding of security practices.

Overly Complex Infrastructure

Human error typically occurs when the complexity of our environment increases beyond what we were used to. Quickly creating resources, adding components or new containers, and changing configurations within a scalable architecture — these are all common origins of errors.

While these actions are needed to grow your business, it is important to implement a set security checklist. For without some form of standardization within your environment, you may struggle to ensure that all components are configured and secured correctly.

Insufficient Understanding of Security

Most developers and DevOps teams do not prioritize security when developing and working with applications and infrastructure. These teams mainly focus on ensuring that services are working and are providing functionality.

Therefore, it is key to keep security in mind when hiring your development team. Ensure they understand important concepts like encryption at rest, the principle of least privilege and application hardening.

Paying closer attention to cloud configurations may seem tedious initially, but it pays off in the long run.

Tips for Reducing Misconfiguration

Luckily, there are many solutions and processes we can implement to mitigate the risk of misconfigurations and significantly reduce the likelihood they will occur.

Below are some examples of tools and techniques that your IT teams can deploy, depending on the nature of your environments and organization.

Adopt a Change Management Practice

Change management practices, such as a regular change cadence and a change review group, can significantly reduce the chance of misconfiguration.

Scheduling, reviewing and implementing changes in a standardized manner reduces the risk of misconfiguration significantly, without additional tools.

Simplify Your Environments

Rather than having custom infrastructure for every component deployed within your environment, standardize a few components and deploy them using templates.

This standardization allows team members to spot different component configurations quickly and makes managing the entire environment more straightforward.

Document Everything

Ensure your team maintains and backs up environment documentation and configurations like any other critical data set to compare the current environment with the intended environment.

Documenting configurations and environments may seem tedious at first, but the extra work will become beneficial in the long run. These documents will play a key role in helping you and your team track what goes wrong, troubleshoot and help you figure out what to do in the future.

Adopt an Infrastructure-as-Code Practice

Building on the idea of a change management practice, we recommend adopting tools and processes to build infrastructure as code. It is much harder to make configuration mistakes when you are defining your infrastructure as code and reviewing it regularly.

It is also much easier to prevent configuration drift and roll back unintended changes if you adopt continuous delivery tools that keep your configurations evergreen.

Scan for Vulnerabilities

We also recommend scanning your environment regularly for any vulnerabilities. This scanning includes everything from static and dynamic application security testing to scanning networks and firewalls to ensure that ports and routes remain locked down.

Various configuration code scanners, like Bridgecrew and Snyk, enable your team to find and fix common configuration errors in your infrastructure-as-code frameworks.

Perform Penetration Testing

As well as regular vulnerability scanning, running actual penetration tests against your environment and applications can help find and fix potential weak points within your architecture.

Penetration testing can be pretty costly, as it is a specialized service. But having some form of regular penetration testing ensures that your application is as robust as possible.

Adopt a DevSecOps Culture

Security has long been an afterthought in the development and deployment process. A development, security and operations (DevSecOps) culture addresses this by integrating security as an aspect of application design and development.

Having knowledgeable security resources on your application design and development teams helps bake security into your application’s foundation. This will save you the headache of fixing problems after, by preventing them in the first place.

Next Steps

Even within today’s brilliant technological field, misconfiguration is still a common occurrence in cloud environments, causing system outages and data breaches in companies of all sizes.

You can solve various misconfigurations using a more defined, standardized approach to security, and baking this approach into your development processes and tools. By expanding development practices into your infrastructure management and adding a security focus, you can drastically reduce the impact and occurrence of misconfigurations.

To explore more about common security issues and how to prevent them, check out CircleCI’s ebook “6 Paths to Application Security.”

InApps Technology is a wholly owned subsidiary of Insight Partners, an investor in the following companies mentioned in this article: Saturn.

Photo by Mateus Rauber from Pexels.