Cloud storage exposure
Cloud storage exposure arises when data that ought to be private becomes publicly reachable through a bad configuration of a cloud service. That can be S3 buckets, blob storage, backups, logs, documents, images, database exports or configuration files.
Term
description · examples · notesCloud storage exposure arises when data that ought to be private becomes publicly reachable through a bad configuration of a cloud service. That can be S3 buckets, blob storage, backups, logs, documents, images, database exports or configuration files.
Description
Usually there is no break-in; somebody sets up temporary storage, opens it to test sharing, moves production data across for analysis, or leaves a backup somewhere with poor access control. Automated scanners look for such mistakes constantly, so exposure rarely stays unnoticed.
The damage often does not end with the documents. The same storage can hold API keys, passwords, configurations and backups that open the next level of access. One public folder in the cloud easily becomes the road to the rest of the environment.
Examples
- A cloud bucket holding scanned contracts stays public through a wrong sharing setting.
- A database backup with employee data sits in storage with no access control.
- A configuration file with an access key sits in publicly readable cloud storage.
Notes
- Open storage is not broken into. Knowing its address is enough.
- A backup without access control is not protection but a copy of the incident waiting to be found.
Mentioned in the news
Techniques
carried out with 3Techniques used to carry it out. Select one to open its page.
Defenses
countered by 5How it is defended against. Select one to open its page.