Most security issues in the cloud can be traced back to someone doing something stupid.
I do see misconfigured cloud resources, such as storage and databases, that lead to vulnerabilities that could easily be avoided.
Although cloud squatting is being pushed as a new threat, we've known about it for years.
What changed is that as we move more assets into the public cloud and have new people taking care of these assets, there seems to be a renewed interest in this vulnerability.
The core issue is that cloud asset deletions often occur without removing associated records, which can create security risks for subdomains.
Failure to also delete records allows attackers to exploit subdomains by creating unauthorized phishing or malware sites.
Allocating assets such as virtual servers and storage space is quick, generally done in seconds, but deallocation is more complex, and that's where the screwups occur.
We're seeing the creation of multiple records pointing to temporary cloud resources for different applications and tools; then organizations fail to delete cloud assets and associated records.
Identifying and fixing cloud squatting is challenging for large enterprises with vast amounts of domains.
Global infrastructure teams have varying degrees of training, and with 100 or more people in the security admin team, you're bound to run into this problem a few times a month.
These tools check the validity of IP records assigned to the company's assets.
These are assigned automatically by cloud providers.
Mitigating cloud squatting is not just about creating new tools.
This means transferring their owned IP addresses to the cloud, then maintaining and deleting stale records, and using DNS names systemically.
The idea is to remove the ability for old, undeleted records to be exploited.
Second, enforce policies for using DNS names, and regularly maintain records for effective management.
Two things are occurring right now that are causing cloud squatting to become more of a threat.
The issue is the rapid expansion of cloud deployments during the pandemic.
Massive amounts of data were pushed into the clouds, with domains allocated to find that data and little thought about removing them when they became unnecessary.
Most of these issues can be traced to inadequate training or hiring lower-tiered cloud administrators to keep things going.
This Cyber News was published on www.infoworld.com. Publication date: Tue, 26 Dec 2023 10:13:30 +0000