4 ms·
I mean, it's the usual story with these things — "accidentally stored internal data — including other companies' security sensitive data — in a public file shar
by decasia 7y ago
I mean, it's the usual story with these things — "accidentally stored internal data — including other companies' security sensitive data — in a public file share" (or in this case, S3). Not much to learn from the story that we don't already know about IT security. Bottom line, it's bad to trust vendors that are not trustworthy, and this can expose other kinds of lazy/bad practices in your organization.
For a company that had thousands of clients, I didn't think 1TB was an especially large amount of data, all things considered.
- Skunkleton 7y agoThe article actually says that only ~1 TB was downloaded by the researcher. The real size is unknown.
- OrgNet 7y ago> or in this case, S3 S3 is very common when it comes to leaks for some reason
- deleted 7y ago[deleted]
- zwily 7y agoI’d say one big reason would be because so many people use it.
- slenk 7y agoAnd it used to be VERY easy to make them public. Amazon has recently been showing a lot more warnings if you try it now.
- eli 7y agoDespite recent improvements, it's still pretty easy to accidentally make a bucket public that you meant to keep private.
- je42 7y agoYep. As a bigger org you want automatic compliance checks that verify that all buckets are not publically accessible.
- mwarkentin 7y agoThey have explicit public access blocks at both the bucket and account level now. These override any permissions granted via IAM or bucket policy.
- je42 7y agoThat's why you still want explicit automatic audits.
- continuational 7y agoAWS has a very complicated configuration format for permissions. In security, complicated = insecure.
- late2part 7y agoStimson's quote doesn't seem appropriate here... "The only way to make a man trustworthy is to trust him; and the surest way to make him untrustworthy is to distrust him and show your distrust."
- golem14 7y agoThere’s trust and there’s trust. I might trust Tom Bombadil not to murder me in my sleep. I might not trust him as a keeper of the one ring …