Misconfigurations in major cloud offerings examined

Misconfiguration concerns are prevalent across Microsoft Azure, Google Cloud Platform, and Amazon Web Services, with 99% of Azure disks lacking encryption or customer-managed keys, according to TechRepublic. Automatic key rotation was also disabled in Azure, with 85% of keys not being rotated, while 97.5% of virtual machine disks for critical VMs in GCP also had no encryption, a report from Qualys showed. Moreover, 44% of IAM users with console passwords in AWS did not have multifactor authentication enabled, while authentication and client certificate configuration scans in Azure App Service had a 97% failure rate. Public access was also possible for 75% of Azure databases and 31% of AWS S3 buckets. The findings also showed that GCP, Azure, and AWS had 60%, 57%, and 34% Center for Internet Security benchmark failure rates, respectively. "The lesson from these data points is that almost every organization needs to better monitor cloud configurations. ... Even if you believe your cloud configurations are in order, the data tells us that not regularly confirming status is a risky bet. Scan the configurations often and make sure the settings are correct. It takes just one slip-up to accidentally open your organizations cloud to attackers," wrote Qualys Threat Research Unit Vice President Travis Smith.