Threat, Vulnerabilities and Mitigations: Cloud Vulnerabilities Flashcards
What are the cloud storage threats?
Are you storing sensitive data in open public storage? There can be weaknesses:
Storage services: Could have weaknesses due to misconfiguration in access controls or because data is put in open storage accidentally or unknowingly. Check out https://buckets.grayhatwarfare.com/.
Leaked keys: Used for programmatic access to cloud services, they can get leaked because they’re:
Stored in open cloud storage..
Hard-coded into an app/scripts/configs
Transferred in a less than secure way, such as over a plain-text network.
Identity and access management (IAM) misconfiguration: Incorrect setting of access controls can be a weakness, as accounts have access to things they shouldn’t have access to.
Application vulnerabilities: Your cloud service has an operating system on it, such as Linux or Windows, and those operating systems have vulnerabilities. You also might have weakness in:
Web apps: such as the HTTP Server App or content management system (CMS).
Serverless/Function-as-a-Service(FaaS).
Software apps such as network services or Customer Relationship Management (CRM) software.
What are the other issues?
Weak or no security controls.
Denial-of-service (DoS) attacks.
Insider threats: intentional or unintentional.
