Cloud computing offers a wide array of benefits, but it also opens potential gaps in enterprise data security. A review of common cloud misconfiguration errors can help foster better data protection.

By John Ghrist

Getting the most out of cloud computing obviously varies across enterprises, depending on which aspects of the technology work best for a given organization operating multiple lines of business. Now that the technology is maturing, larger organizations in particular may find that a single private cloud is insufficient and opt for either a hybrid cloud configuration for flexibility or for using services from multiple cloud service providers (CSPs) because different vendors offer different flavors of products and services that each meet a particular need for specific product or service offerings. While the broadest range of options puts the most tools at an enterprise's disposal, this added complexity can create opportunities for errors that can nullify even the best attempts to maintain data security. Overcoming these challenges is essential.

Common Causes of Misconfiguration Loopholes

There are many potential sources of misconfiguration problems. Perhaps the most common is to leave default settings unchanged after a system's initial installation. Default configurations typically provide shortcuts for system installation (e.g., generic usernames for specific roles, simple passwords, standard system settings), many of which are known to hackers through publicly available documentation. Similarly, some feature applications may not be necessary for a particular installation but are enabled by default to simplify installation for customers who are paying for them. There may also be high permissions initially granted to certain users or apps to simplify system setup that are never reviewed or revised until a breach or other problem occurs later.

Improper initial training is another general source of potential problems. Administrators may lack awareness of security implications, prompting them to take shortcuts to expedite production launches. Lack of diligence in reviewing all aspects of user manuals for new systems and services can leave system operators with a faulty understanding of the capabilities of the tools and other features at their disposal. The lack of an overall configuration management tool may lead to unnoticed errors in initial configuration and audit actions. Application programming interfaces (APIs) that were previously functional under a prior cloud configuration may allow unintended access to unauthorized transactions or sensitive data. Lax directory and file permissions, database configuration errors, and misconfigured cloud storage can degrade system performance or create openings for unauthorized users to cause issues. Failure to encrypt sensitive data is apparent, but worth noting. A heavy reliance on vendor defaults and best-practice recommendations before deploying the system to production could overlook critical vulnerabilities unique to the user organization’s environment.

Sometimes, error handling can cause a misconfiguration effect. For example, apps that generate overly specific error messages (e.g., end-user database messages or stack traces) can give attackers clues to penetrate systems further. If event logging is overlooked or the logs aren't sufficiently protected, essential events may not be recorded, or the logs may be insufficiently valuable for diagnosing specific problems.

Cross-Origin Resource Sharing (CORS) is a web browser security mechanism that allows browsers to access data from other ports or domains, based on the results of an automated access request. CORS with a lax configuration can allow external scripts or websites to access inadequately protected endpoints, opening the door to unauthorized actions or data breaches—even if the CORS had previously seemed adequate.

Once the system is up and running, unauthorized entry points may remain. Unused ports on servers may exist under a new system configuration, creating weaknesses that attackers can exploit if regular vulnerability testing isn't part of the management protocol. Security patches released over time may not be applied promptly, and even when applied, they can still cause drift in system configuration that may introduce new vulnerabilities. Incompletely structured update procedures or Insufficient testing of configuration updates as the system evolves can also be sources of difficulties.

Identifying Misconfigurations

Naturally, it's best to find misconfigurations before a data breach or some other calamity brings them to the attention of upper management or customers. Of primary importance is understanding that cloud technology requires its own in-house troubleshooting team, preferably a group of people who don't have other duties that distract from daily monitoring of systems for trouble, which is separate from vendor support teams, and which has a proactive attitude about finding and identifying misconfiguration problems. Although CSPs provide cloud infrastructure and often include built-in tools to help, customer sites ultimately remain responsible for securing the cloud configuration and its associated apps.

Detecting misconfigurations effectively relies on a structured approach that combines manual and automated methods. The team will need to use specialized tools to scan for weak configurations across the network and cloud, as well as for open ports and other vulnerabilities.

Security baselines should be documented before a cloud system is deployed, and the team should regularly run audits comparing system scans against these recommendations. The team must maintain and periodically review system and application logs to detect unusual activity and treat it as a clue to potential problems. Ideally, the team will conduct simulated attacks to understand potential attackers' perspectives and identify issues that automated tools may have missed.

Misconfiguration Remediations

Depending on the nature of the misconfiguration, some remedies are straightforward. Always disable unused ports and services, employ firewalls with strict rules, review and update virtual private network configurations, use network microsegmentation to keep workloads isolated, be sure cloud resources are consistently tagged and managed, and establish a policy that ensures that all configuration changes undergo peer review, version controls, and an approval chain.

Microsegmentation also aligns with the concept of "least privilege," a security principle that grants only the permissions necessary to authorized users and provides them with only the minimum access required to perform their job functions. This protocol is also sometimes referred to as Identity and Access Management (IAM), which is a framework for controlling user access to sensitive information by matching digital identities with specific corporate roles and assigning individual levels of access to networks and data based on each role's "need to know." A common mechanism for this categorization is the use of Access Control Lists (ACLs), which specify which roles have access to which resources and the actions they can perform on those resources.

While the concept is sound, misconfigured ACLs can allow attackers to assume privileges they aren't entitled to and use that access to cause data breaches or otherwise interfere with normal business operations. ACLs typically come in two flavors: file system and network. The former controls user availability to directories and files on a system, and the latter enables access to network resources such as firewalls and routers. ACLs usually specify a user or group that's the subject of the access restriction, the specific actions that group members can perform, and the level of access each digital role is permitted.

One of the most common misconfiguration errors is granting full access to resources to accommodate all authorized users. Attackers can exploit this to access files with root privileges (particularly on Linux-based systems), giving themselves administrator-level access to most network resources. In Windows-based networks, intruders can access the New Technology File System (NTFS) and use a file with administrative access to elevate privileges for the role they have assumed and execute administrative commands. Another common problem is that ACLs granted to shared resources can allow standard user accounts to be used by attackers to modify critical files or access administrative tools.

These examples, and other intrusions too numerous to spell out here, can be overcome by applying the principle of least privilege to all ACLs, to automatically flag for administrators any changes made to any ACL, by setting up regular audits of ACL privileges, and by restricting access to configuration management tools to as few administrative roles as possible.

More broadly, configuration problems can be contained by assigning internal names for (tagging) and managing all cloud resources, giving administrators network logging and monitoring tools, deactivating unused services, regularly reviewing (and when necessary, modifying) virtual private network (VPN) configurations, using state-of-the-art firewalls, and above all, training administrative teams on configuration security to reduce human errors committed out of ignorance.

Best Practices for Preventing Misconfigurations

Strong security defenses and strict rules governing network activity are key to avoiding misconfiguration problems in the first place. Implementing strong passwords with multifactor authentication for all authorized users, changing default credentials before moving a configuration to production, and enforcing regular resource auditing and prompt updates of all software, firmware, and patches are the first steps.

Use scanning tools to check for vulnerabilities, sometimes available from CSPs or third parties. There are also several open-source tools in wide use, including:
            • Nmap, which checks for default logins on network services if scripts or credentials are supplied,
            • OpenVAS, which offers both vulnerability scanning and performance tuning capabilities,
            • Prowler, an Amazon Web Services (AWS) tool that identifies misconfigurations and other security risks,
            • CloudSploit is a risk detector for cloud infrastructure security risks across multiple cloud platforms.

Disable features not required in the current environment to reduce attack surfaces within the system. Consider building a vulnerability management program that provides a structured approach with checklists to guard against the most common security vulnerabilities, or at least implement a plan to log security events across the network with centralized monitoring that aggregates logs from multiple sources. Encrypt all data and keep encryption algorithms up to date. Institute traffic rules for inbound and outbound traffic that minimize unnecessary access.

No amount of vigilance or use of administrative tools is foolproof, because many misconfigurations result from human error. However, dedicated teamwork, training, and awareness of potential issues are among the best ways to minimize the damage misconfigurations can cause.

John Ghrist has been a journalist, programmer, and systems manager in the computer industry since 1982. He has covered the market for IBM i servers and their predecessor platforms for more than a quarter century and has attended more than 25 COMMON conferences. A former editor-in-chief with Defense Computing and a senior editor with SystemiNEWS, John has written and edited hundreds of articles and blogs for more than a dozen print and electronic publications. You can reach him at This email address is being protected from spambots. You need JavaScript enabled to view it..