Several high-profile breaches involving misconfigured Amazon Web Services servers have made the news. Here are three best practices to ensure AWS S3 security.

Amazon Web Services (AWS) is the undisputed leader in the cloud services market. Large and small organizations alike flock to AWS because of its flexibility, full array of options and upgrades, and pay-as-you-go-for-what-you-use price structure. However, numerous data breaches have been traced back to misconfigured Amazon Simple Storage Service (S3) buckets, including high-profile breaches of third-party vendors handling sensitive information on behalf of Verizon and the Republican National Committee. This has some AWS customers questioning their AWS S3 security, particularly in light of the fact that Amazon itself sent an email to customers with publicly accessible S3 buckets, warning them to review their AWS S3 security settings.

The good news is that AWS is very secure – if configured properly. Breaches are completely preventable by following simple, proactive cloud security best practices grounded in sound governance, risk, and compliance. Here are three proactive steps you can take to enhance your AWS S3 security; these apply to competing cloud services as well.

Create consistent cloud security controls and procedures, and put them in writing

All of the recent S3 breaches have involved S3 buckets that contained sensitive data and that had been set to public. By default, S3 buckets are set to private, meaning that only the account owner can access their contents. Buckets are not set to be publicly viewable by accident; someone with the privileges to do so must go into the system and take specific steps to override the default setting. This begs two questions: Why was this sensitive data sent to the cloud in the first place? Why did someone override the default and make them public?

A set of written cloud security controls and procedures clearly defines which types of data are to be stored in the cloud, how long they are to be kept there, and where they belong in the cloud storage hierarchy. Not only should sensitive information never be placed in a public S3 bucket, but also, access to buckets containing sensitive information should be highly restricted. This leads to the next best AWS S3 security best practice.

Perform regular reviews of your accounts, groups, users, and roles

In addition to allowing S3 buckets to be set to public or private, AWS allows administrators to give users varying levels of access to buckets and their contents, including list, upload, delete, view, and edit functions. Your organization’s AWS server should be treated just like the rest of your network: Users should be given the minimum amount of access they need to perform their jobs and no more. When employees leave the company or transfer into other positions, their access should be immediately revoked or altered as appropriate, and everyone’s permissions should be regularly reviewed to ensure they have the appropriate level of access and that there is no unnecessary overlap between user groups.

Perform regular risk assessments

Just like the rest of your cyber security protocols, your cloud security procedures should be regularly reviewed and updated as the threat environment and your organization’s needs change. Then, all of the buckets, files, and users on your AWS servers should be examined to ensure they meet the new protocols.

Despite the popularity of cloud computing, cloud security often takes a backseat to other aspects of enterprise security because organizations think that their cloud provider “handles all of that.” In reality, your cloud provider’s responsibility is limited because, in the end, it is your data. They have no control over what types of data you store in the cloud, who you allow to access it, whether you encrypt it and how, or whether you are complying with any applicable industry and regulatory standards, such as PCI DSS and HIPPA. If your S3 bucket is breached because you made a mistake, Amazon won’t be responsible for the fallout; your organization will.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call +1 (888) 896-6207 or complete the form below to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

Schedule some time with our Superheroes for a Free Assessment!

HBO Hack Targeted Valuable Intellectual Property and Company Secrets

Corporate espionage and the theft of intellectual property and company secrets have gone cyber. The latest victim is cable network HBO and its flagship series Game of Thrones. The HBO hack, perpetrated by a hacker or group calling themselves “Mr. Smith,” may involve as much as 1.5TB of data. Mr. Smith has been releasing their treasure trove in increments; so far, they’ve leaked five Game of Thrones draft scripts, complete unaired episodes of Curb Your Enthusiasm and several other HBO series (although not GoT), the personal contact information of several GoT actors, company emails from HBO’s vice president of film programming, login credentials for HBO’s internal systems, and numerous other confidential documents.

The HBO hack has been compared to the 2014 Sony Pictures hack, which involved the release of scandalous company emails. However, there are more similarities to the Netflix hack in April, where hackers stole upcoming episodes of Netflix’s smash hit Orange is the New Black and dumped them online after Netflix refused to pay a ransom.

Hackers are Coming

The latest Verizon data breach report highlighted cyberespionage and digital IP theft as growing threats. The manufacturing industry, professional services, education, and the public sector were noted as being especially vulnerable, but any industry could be victimized.

Hackers are still very interested in stealing identities and payment card data, but there’s arguably even bigger money in stealing digital intellectual property. Mr. Smith is threatening to release more data from the HBO hack – including full GoT episodes – unless the network pays them six months’ worth of the $12 to $15 million they claim to earn annually from cyber crime. HBO has offered Mr. Smith $250,000 as a “bug bounty” payment, which Mr. Smith has scoffed at.

Lessons from the HBO Hack

Entertainment companies make particularly attractive targets for three primary reasons, all of which also apply to organizations far removed from the Hollywood spotlight.

The entertainment industry’s entire business model is built around intellectual property. Hollywood sells nothing but content, and they are always making more of it. The same applies to software, game, and web development companies, as well as any business that sells content as opposed to widgets. Even companies that don’t actually sell intellectual property are in possession of some: Think secret sauces, R&D data, product prototypes, proprietary software packages, and vendor and customer lists. The Houston Astros MLB team lost millions of dollars when a competing team hacked their database and stole information on potential prospects and trades.

The industry is going digital. Film cans are being replaced by hard drives, consumers have come to expect online streaming options, and everything that’s ancillary to productions, such as scripts, lists of shooting locations, and actors’ personal information, is stored on networks. As organizations move from storing records in file cabinets to storing them on hard drives and in the cloud, hackers have more access points to more digital IP and company secrets than ever before.

The typical Hollywood studio has a complex cyber ecosystem. Film and TV studios depend on numerous third-party vendors to perform services, from sound dubbing to film editing, that involve access to company data. Often, these businesses are small and do not have the same level of cyber security as major studios. The Netflix hack was traced back to a breach at a small, third-party vendor – as was the latest Anthem breach and other recent breaches impacting Google, Trump Hotels, and Verizon. Outsourcing IT services to third-party vendors is commonplace in the digital age, so it is critical for all organizations to secure their entire cyber ecosystem, including business associates who have access to company data.

Hackers will keep engaging in digital IP theft because it’s lucrative. Companies will pay big bucks to protect their intellectual property and trade secrets. It’s far less expensive to invest in proactive cyber security and prevent IP theft from happening in the first place.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]

Verizon, Trump Hotels, and the RNC are Among the Recent Victims of Third-Party Breaches

Even if your own cyber security is up to snuff, your organization could be at risk of third-party breaches if your business partners are not as diligent as you are. Verizon just learned this lesson the hard way after one of its vendors, telephonic software and data company NICE Systems, left the information of 14 million Verizon customers on a misconfigured Amazon server.

This incident did not happen in a vacuum. Other recent third-party breaches affecting major organizations include:

• The Republican National Committee (RNC), whose data analytics vendor exposed the data of 198 million voters after leaving it on – you guessed it – a misconfigured Amazon server.
• Trump Hotels, which, along with chains such as Hard Rock and Four Seasons, had its customer data exposed after a breach at its reservations vendor, Sabre Corporation.
• A number of Google employees were also impacted by the Sabre breach because Google’s third-party travel management company used Sabre’s systems – meaning this breach happened at the third-party vendor of a third-party vendor.
• Netflix, which had the upcoming season of its hit series Orange Is the New Black dumped online after a hacker breached a third-party post production house, Larson Studios. It has since been discovered that the hackers got into Larson’s systems by taking advantage of the fact that the company was running an antiquated version of Windows.

Third-Party Breaches Common in the Age of Outsourcing

Once a dirty word, outsourcing is a normal part of doing business in the 21^st century. Organizations of all sizes routinely retain the services of third-party business partners to take care of all manner of functions outside their core competencies, from cloud storage to customer billing to payroll services. Unfortunately, because so many business functions are now outsourced, third-party breaches have more common than primary data breaches; an estimated 63% of all enterprise breaches can be traced back to a third-party vendor.

If one of your vendors gets hacked, don’t expect to be able to point fingers and pass the buck. Even if your business partner makes a colossal mistake, your organization will be the one that’s held responsible by your customers, any affected banks, and regulatory bodies. The infamous Target breach, which cost the company nearly $300 million and shook up its C-suite, involved a third-party vendor.

Protecting Your Organization from Third-Party Breaches

As with primary cyber attacks, the best way to deal with third-party breaches is to prevent them from happening in the first place. While you cannot dictate to your business partners how they should run their firms, as their paying customer, your enterprise is not without recourse:

• Understand your enterprise ecosystem so that you can build risk profiles for all of your business partners. Who are your business partners, and what service does each provide? What level of access do they have to your data and systems?
• Understand who your vendors are subcontracting to and whether they will have access to your data. As in Google’s case, a breach at a third-party vendor used by one of your third-party vendors can come back to haunt your organization.
• Include cyber security provisions in your vendor contracts, including security measures your business partners must take regarding their own vendors.
• Give your vendors the minimum level of access to your systems and data that they need, and no more.
• Only do business with IT services vendors who have released AICPA SOC / SSAE16 reports and/or who have important IT security certifications such as NIST, ISO, or FedRAMP. These organizations have undergone rigorous security audits and have proven their commitment to the highest levels of data security.

Further to the above, if your business provides IT services to other businesses, obtaining the appropriate data security certifications is a wise investment that will help you instill trust in your customers. Continuum GRC’s IT Audit Machine (ITAM IT audit software) RegTech solution empowers organizations to get and maintain compliance the easy way, with self-help modules covering numerous compliance standards, including FedRAMP, SSAE 16, AT 101, CJIS, DFARS, COBIT, ISO 27001, ISO 27002, ISO 27005, SOX, FFIEC, PCI, GLBA, HIPAA, CMS, NERC CIP and other federal and state mandates.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call +1 (888) 896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

Schedule some time with our Superheroes for a Free Assessment!