Amazon corrige sa configuration cloud après de nombreuses pertes de données

Ces derniers mois, des erreurs de configuration de la sécurité de services cloud sont à l’origine de graves divulgations involontaires de données. De par ses parts de marchés, ce sont bien sûr les services S3 d’Amazon qui ont été souvent mis à mal.

Des erreurs de configuration et non des vulnérabilités

De plus en plus souvent, la vulnérabilité se trouve entre la chaise et le clavier. Les dernières mésaventures de pertes de données sur S3 sont là pour le rappeler.

Pour améliorer la situation, Amazon a pris le taureau par les cornes et propose entre autre maintenant de chiffrer par défaut toutes les données stockées sur son cloud.

New Amazon S3 Encryption & Security Features | Amazon Web Services

Back in 2006, when I announced S3, I wrote  » Further, each block is protected by an ACL (Access Control List) allowing the developer to keep the data private, share it for reading, or share it for reading and writing, as desired. » Starting from that initial model, with private buckets and ACLs to grant access, […]

et pour en savoir plus sur ce sujet:

https://businessinsights.bitdefender.com/amazon-stop-s3-buckets-leaking-data

7% of All Amazon S3 Servers Are Exposed, Explaining Recent Surge of Data Leaks

During the past year, there has been a surge in data breach reporting regarding Amazon S3 servers left accessible online, and which were exposing private information from all sorts of companies and their customers.

et voici un florilège de boulettes de configuration:

Australian Broadcasting Corporation confirms S3 data leak

The government-backed broadcaster has confirmed that data from an unsecured repository was exposed.

Massive US military social media spying archive left wide open in AWS S3 buckets

Dozens of terabytes exposed, your tax dollars at work

CXO Archives

In this TechRepublic Premium guide, technicians can learn how to properly structure service tickets, gain appreciative customers and end users, and improve customer satisfaction (or CSAT) scores which will reward your efforts. From the guide: INTRODUCTION It’s tempting, in the heat of the typical support technician’s day, to enter minimal information in service tickets to …

Verizon Hit by Another Amazon S3 Leak

Verizon Hit by Another Amazon S3 Leak. Engineer-owned bucked containing data marked ‘confidential’ exposed

Leaky S3 bucket sloshes deets of thousands with US security clearance

Bunch of resumés citing secret government work exposed

Accenture left a huge trove of sensitive data on exposed servers

The four exposed servers had no password, but contained the « keys to the kingdom. »

A Misconfigured Amazon S3 Exposed Almost 50 Thousand PII in Australia

A misconfigured Amazon S3 bucket has accidentally compromised 48,270 personally identifiable information (PII) from Australian employees working in government agencies, banks, and a utility company.