Ces derniers mois, des erreurs de configuration de la sécurité de services cloud sont à l’origine de graves divulgations involontaires de données. De par ses parts de marchés, ce sont bien sûr les services S3 d’Amazon qui ont été souvent mis à mal.
Des erreurs de configuration et non des vulnérabilités
De plus en plus souvent, la vulnérabilité se trouve entre la chaise et le clavier. Les dernières mésaventures de pertes de données sur S3 sont là pour le rappeler.
Pour améliorer la situation, Amazon a pris le taureau par les cornes et propose entre autre maintenant de chiffrer par défaut toutes les données stockées sur son cloud.
L'essentiel Cybersécurité, IA & Tech
Rejoignez la communauté. 3 fois par semaine, recevez l'analyse des tendances par Marc Barbezat. Pas de spam, juste de l'info.
New Amazon S3 Encryption & Security Features | Amazon Web Services
Back in 2006, when I announced S3, I wrote » Further, each block is protected by an ACL (Access Control List) allowing the developer to keep the data private, share it for reading, or share it for reading and writing, as desired. » Starting from that initial model, with private buckets and ACLs to grant access, […]
et pour en savoir plus sur ce sujet:
https://businessinsights.bitdefender.com/amazon-stop-s3-buckets-leaking-data
7% of All Amazon S3 Servers Are Exposed, Explaining Recent Surge of Data Leaks
During the past year, there has been a surge in data breach reporting regarding Amazon S3 servers left accessible online, and which were exposing private information from all sorts of companies and their customers.
et voici un florilège de boulettes de configuration:
Australian Broadcasting Corporation confirms S3 data leak
The government-backed broadcaster has confirmed that data from an unsecured repository was exposed.
Massive US military social media spying archive left wide open in AWS S3 buckets
Dozens of terabytes exposed, your tax dollars at work
CXO Archives
In this TechRepublic Premium guide, technicians can learn how to properly structure service tickets, gain appreciative customers and end users, and improve customer satisfaction (or CSAT) scores which will reward your efforts. From the guide: INTRODUCTION It’s tempting, in the heat of the typical support technician’s day, to enter minimal information in service tickets to …
Verizon Hit by Another Amazon S3 Leak
Verizon Hit by Another Amazon S3 Leak. Engineer-owned bucked containing data marked ‘confidential’ exposed
Leaky S3 bucket sloshes deets of thousands with US security clearance
Bunch of resumés citing secret government work exposed
Accenture left a huge trove of sensitive data on exposed servers
The four exposed servers had no password, but contained the « keys to the kingdom. »
A Misconfigured Amazon S3 Exposed Almost 50 Thousand PII in Australia
A misconfigured Amazon S3 bucket has accidentally compromised 48,270 personally identifiable information (PII) from Australian employees working in government agencies, banks, and a utility company.
Cette veille indépendante vous est utile ?
Offrez un café pour soutenir le serveur (et le rédacteur).
6 commentaires
et encore ici :
Massive Cloud Leak Exposes Alteryx, Experian, US Census Bureau Data
A misconfigured Amazon Web Services S3 storage bucket exposed sensitive data on consumers’ financial histories, contact information, and mortgage ownership.
https://www.darkreading.com/cloud/massive-cloud-leak-exposes-alteryx-experian-us-census-bureau-data/d/d-id/1330673
Pas mieux ici: http://www.zdnet.com/article/national-credit-federation-leaked-us-citizen-data-through-unsecured-aws-bucket/
et encore un autre cas : https://www.infosecurity-magazine.com/news/100gb-secret-consumer-credit-data/
et encore un nouveau problème : http://www.lemondeinformatique.fr/actualites/lire-un-sous-traitant-du-pentagone-laisse-fuiter-1-8-milliard-de-posts-sur-s3-70030.html
Commentaires désactivés.