Page 94 - CDM-CYBER-DEFENSE-eMAGAZINE-December-2018

The challenge is that many organizations struggle to adopt and enforce best practices consistently, and
only 100% consistency can ensure protection against a breach. This is why an investment in cloud
operations is a vital additional step.

Invest in Cloud Operations:

Cloud operations, or CloudOps, is the combination of people, processes, and tools that allow for
organizations to consistently manage and govern cloud services at scale. Key to this is hiring and
developing the right people, identifying processes that address the unique operational challenges of cloud
services, and the automation of these processes with the right tools. One vital tool in your CloudOps
toolkit should be software that monitors and remediates cloud misconfigurations allowing you to achieve
continuous security and compliance at scale.

For example, using said tool, an organization will be able to leverage automation to remove the public
permissions from the access control list where necessary. Users should also be able to leverage bucket
policies in place of access control lists for the finer-grained access control. This automation prevents data
breaches by finding, alerting, and remediating misconfigured storage containers way before
vulnerabilities are exposed.

It’s important to highlight that these cloud management platforms should not only flag the problem in real-
time but give the user an exact pointer to where the problem is. If somebody were to tell you “there is an
open S3 bucket” but didn’t narrow down to a granular level, where would you start? This is why the cloud
management platform you choose should alert that there is an open S3 Bucket, then take action and
inform the user to exactly which bucket in which account.

In the end, the way to avoid exposing data in S3 buckets is really common sense: Don’t ever configure
the S3 buckets to be exposed to the public. Organizations need to learn about security configurations
while evaluating their public cloud options or pay someone else to do it for them. Otherwise, it’s only a
matter of time before they join the 12 aforementioned organizations in the growing list of those who have
to explain to their customers that their information has been compromised.

94