One of my clients had gone to extremes to harden his app, implement rigid IAM & access controls, encrypt file & database, implement hardware security keys, and hand wire least privilege HTTPS communications among all services and microservices. BUT on review, he had not disabled the unrestricted HTTP connection to the S3 buckets where he automatically backed up critical data.
Yet again this demonstrates that the most vulnerable components are also the ones that are most fallible... the human.
------------------------------
Paul Deaver CISSP, CCSP
Anodyne Enterprise Security, LLC
------------------------------
Original Message:
Sent: Nov 06, 2020 05:20:24 PM
From: Jenna Morrison
Subject: Cloud Security Infrastructure Weaknesses?
Hello all!
As I've continued to go through the CCSK training, one part piqued my interest in Module 2 Unit 2 which talked about securing cloud infrastructure.
My question is, are there certain elements within the cloud infrastructure that are more vulnerable than others to attacks? Or are hacked more frequently? If so which ones?
Additionally I've been hearing the term: 'Topology' and wanted a clearer understanding of what this means as it relates to cloud security.
Thank you!
------------------------------
Jenna Morrison
Intern
Cloud Security Alliance
------------------------------