Cloud Service Misconfigurations: Emerging Threats, Enterprise Data Breaches and Solutions

Organizations are increasingly relying more on cloud services due to their scalability and reduced maintenance costs. However, there is still a significant amount of configurations required when setting up these cloud services, and when mistakes are made during this process, prices could be high. In this paper, we investigate and identify 6 common cloud service misconfigurations that developers make, and detail the attack vectors that can be exploited. Apart from the study of hypothetical attack vectors, we also analyze and diagram 3 real-world enterprise data breaches that arise as a result of cloud service misconfigurations. Our study shows cloud service misconfigurations often lead to massive data leakage or malicious code injection, and have become major cloud security concerns. It is our hope that this work can shed light on these common mistakes and reveal the extent of the damage that they can cause so that they might be avoided by developers and organizations in the future.