Defense-in-Depth: Stemming Leaks of Sensitive Data from Cloud Storage (Part 3)

In the first and second part of this blog series, we talked about the benefits from using cloud storage, but also the concerns that organizations face when considering adopting it. We showed several incidents where data was stored in cloud storage and it was generally accessible. These incidents highlight the issues with leveraging only the protections built into the cloud storage provider – as a single misconfiguration can mean the disclosure of terabytes of data containing hundreds of millions of sensitive records.

However, the examples we discussed were about political or governmental data, even though usually it leaked through a corporate third-party who had the data. This was the case with the incidents including US Intelligence, US voter data, and Mexican voter records.

Assuming these issues are constrained to just government or political data vastly underplays the risk of critical corporate data being stored on cloud storage without adequate defense-in-depth. One recent example is a leak of records for 14 million users of a major telecommunications provider (Verizon), where the personal details were exposed on a misconfigured cloud storage server of a third-party vendor, NICE Systems.

Finally, although we have focused on data exposed via cloud buckets in this blog series, there are also similar risks from network attached backup storage or exposed databases. For example, in another example of corporate data leaks, River City Media (RCM) had a large amount of backup files correlating real names, email addresses, and sometimes physical addresses for 1.34 billion users allegedly targeted for spam campaigns. Similarly, MacKeeper had exposed database (MongoDB) instances for their customer information and password hashes to the internet, exposing 13 million user records. Many of the same defense-in-depth techniques we discussed in the last post—applying multiple layers of protection and separation of duties, using cryptographic protections, and modernizing to an attribute based access control model—could mitigate these scenarios as well.

Regardless of whether the data is corporate or governmental, or whether it is stored on-premise or in the cloud, these example incidents highlight the need to apply defense-in-depth techniques to data storage and not just rely on the native controls built into a system. In almost all of these cases, misconfiguration of an access control led to massive data leakage. Ionic Security’s products such as Machina Tools for Cloud Storage provide these technical controls – allowing you to implement defense-in-depth for your sensitive data in cloud storage and other environments.