166 terms · 75/46/45
Threat № 074 · class: cloud

Cloud storage exposure

Cloud storage exposure arises when data that ought to be private becomes publicly reachable through a bad configuration of a cloud service. That can be S3 buckets, blob storage, backups, logs, documents, images, database exports or configuration files.

Term

description · examples · notes

Cloud storage exposure arises when data that ought to be private becomes publicly reachable through a bad configuration of a cloud service. That can be S3 buckets, blob storage, backups, logs, documents, images, database exports or configuration files.

Description

Usually there is no break-in; somebody sets up temporary storage, opens it to test sharing, moves production data across for analysis, or leaves a backup somewhere with poor access control. Automated scanners look for such mistakes constantly, so exposure rarely stays unnoticed.

The damage often does not end with the documents. The same storage can hold API keys, passwords, configurations and backups that open the next level of access. One public folder in the cloud easily becomes the road to the rest of the environment.

Examples

  • A cloud bucket holding scanned contracts stays public through a wrong sharing setting.
  • A database backup with employee data sits in storage with no access control.
  • A configuration file with an access key sits in publicly readable cloud storage.

Notes

  • Open storage is not broken into. Knowing its address is enough.
  • A backup without access control is not protection but a copy of the incident waiting to be found.

Mentioned in the news

Composite
Wikipedia

Techniques

carried out with 3

Techniques used to carry it out. Select one to open its page.

Defenses

countered by 5