99 percent of all misconfigurations in the public cloud go unreported

Today’s data breaches often seem to be caused not just by malware infections or external threat actors, but human error, insiders with an ax to grind, and simple security failures.

Some companies will bury their head in the sand, attempting to ignore responsible, private disclosures of data leaks, while others will act rapidly when their information — and reputation — is at stake.

The surge in adoption of cloud-based technologies and Infrastructure-as-a-Service (IaaS) has added a new facet to cyberthreats — the loss of information caused by misconfigurations and weak credentials in the public cloud space.

According to new research released Tuesday and conducted by cybersecurity firm McAfee, titled, “Cloud-Native: The Infrastructure-as-a-Service Adoption and Risk,” the majority of IaaS misconfigurations are going unnoticed.

Indeed, only one percent of IaaS issues are reported, which may suggest there are countless companies across the globe that are unwittingly leaking data.

See also: Cyber security 101: Protect your privacy from hackers, spies, and the government

1,000 IT professionals were surveyed across 11 countries, and cloud usage data from over 30 million McAfee Mvision cloud users was aggregated to compile the report, which also says companies believe they average 37 IaaS misconfiguration issues per month when in reality this number can reach 3,500.

In total, 90 percent of respondents said they had come across security issues with IaaS, but only 26 percent said they were equipped to deal with misconfiguration audits — and this lack of visibility into their cloud usage may be contributing to an increased data breach risk.

According to McAfee, IaaS-based data loss incidents triggered by data loss prevention (DLP) rules have increased by 248 percent year-over-year. As an example, the report says 42 percent of storage objects measured with recorded DLP incidents were misconfigured.

CNET: Amazon looks to expand Alexa’s world amid growing privacy concerns

The report says that the top ten most commonly-misconfigured settings in AWS, the most popular IaaS provider for enterprise firms alongside Microsoft Azure, are as below:

EBS Data Encryption
Unrestricted Outbound Access
EC2 Security Group Port Config
Provisioning Access to Resources using IAM Roles
Unrestricted Access to Non-Http/Https ports
Unrestricted Inbound Access on Uncommon Ports
Unused Security Groups
Unrestricted ICMP Access
EC2 Security Group Inbound Access Configuration
EC2 Instance Belongs to a VPC

Close to a quarter of survey respondents admitted it can take longer than 24 hours to correct reported misconfigurations, and in some serious cases, fixes can take over a month.

TechRepublic: Governments still struggling to contend with weaponized social media platforms

“In the rush toward IaaS adoption, many organizations overlook the shared responsibility model for the cloud and assume that security is taken care of completely by the cloud provider,” said Rajiv Gupta, senior vice president of Cloud Security at McAfee. “However, the security of what customers put in the cloud, most importantly sensitive data, is their responsibility.”

According to research agency Gartner, the worldwide public cloud services market is expected to grow by 17.5 percent over 2019, reaching $214.3 billion. The IaaS segment is predicted to experience the strongest and quickest growth, climbing 27.5 percent to be worth $38.9 billion, up from $30.5 billion in 2018.