Translated from 日本語 • View original 
Recent investigations and incident analyses have shown that many breaches in cloud environments are not caused by "advanced unknown attacks" but by basic mistakes such as "incorrect exposure settings," "excessive authorization," and "inadequate access controls." In other words, there are many cases where there is a high possibility that it could have been prevented if it had been set correctly.
In this article, we will explain why cloud misconfiguration is called the biggest threat, common pitfalls and risks, and preventive measures that organizations should implement in accordance with the concept of defense-in-depth.
Background: Growing cloud usage and the pitfalls of the "shared responsibility model"
Cloud services use the concept of a "shared responsibility model". This clearly separates the responsibilities of cloud providers from those of users. The physical security of the infrastructure itself is managed by the operator, but the user is responsible for OS settings, network control, identity management, and data protection.
Using the cloud without fully understanding this aspect can lead to the following misunderstandings:
- "Security is automatically secure because it's in the cloud"
- "Leave the default settings as fine"
- "You can review it later"
In fact, the cloud has a high degree of freedom, so if it is misconfigured, it will be immediately exposed to the outside world. With the proliferation of remote work and multi-cloud, there are more configuration items and more complexity to manage.
Attack Methods and Risks of Cloud Misconfiguration
Some of the most common misconfigurations in cloud environments and the associated risks include:
- Storage publishing misconfiguration
Storage, which was originally only for internal use, becomes accessible to anyone from the Internet, leading to information leakage. - Excessive IAM permissions
As a result of prioritizing convenience and granting broad authority, the scope of damage in the event of account infringement expands. - Inadequate network control
Administrative ports and APIs are exposed without restrictions and subject to brute force and automated scanning. - Lack of logging and auditing settings
Even if a breach occurs, it is not noticed, making it difficult to investigate the cause and determine the scope of impact.
These misconfigurations can lead to serious damage, such as ransomware infections, information theft, and unauthorized use of cloud resources. Especially in the cloud, attacks are automated, so it's not uncommon for them to be targeted the moment they are published.
Countermeasures: Defend-in-depth practices in cloud environments
To prevent cloud misconfiguration, it's important to go beyond just checklist responses, but to continuously defend in depth.
- Environmental Preparation (Measures at the Design Stage)
IAM design is based on the principle of least privilege, and the network is based on the principle of "private in principle". "Security by design" is important to incorporate security at the time of construction. - Establishment of a monitoring system
Leverage Cloud Security Posture Management (CSPM) and log monitoring to detect configuration changes and suspicious operations. Automatic detection that does not rely on human eyes is key. - test operation
Regularly conduct configuration reviews and pseudo-attack tests to check for "unintentionally exposed assets." Checking from the attacker's perspective is effective. - Rule-making in production
Reduce manual configuration and leverage infrastructure as code (IaC) to manage configurations by code. This prevents personalization of settings and the occurrence of differences. - Continuous Improvement
In light of new cloud capabilities and threat trends, we regularly review configuration standards and operational rules. Security is not created once and finished.
What it should be: Don't make setting mistakes a "premise that won't happen"
The ideal cloud security is a state in which it can be immediately detected and corrected on the premise that a misconfiguration occurs.
As long as people operate it, it is not realistic to reduce mistakes to zero. That's why automation, visibility, and continuous monitoring are so important.
This mindset is also strongly tied to Zero Trust and NIST CSF 2.0.
Related articles:
Conclusion
Cloud misconfiguration is one of the most vulnerable weaknesses in modern cyberattacks. But much of it can be prevented by basic principles and continuous operation.
Instead of postponing setting confirmation because "it's convenient" or "because I'm in a hurry",
Preparing an operational system based on the premise of visibility, automation, and continuous improvement is the shortcut to continuing to use the cloud safely. If you need help, please contact Colorkrew Security.
To maximize the benefits of the cloud, make misconfiguration prevention at the center of your security strategy.