Re:Defense Contractor Left Sensitive Pentagon Files on Unpro...
by cddotdotslash on Wednesday May 31, 2017 @05:19PM
(#14456019)
The main issue is not necessarily security in the traditional sense, but rather the proper use of the security that AWS provides. In this case, AWS more than delivered by providing plenty of options to secure the files. You can make them private, use encryption, generate temporary access URLs, etc. However the user (contractor) simply made a mistake and misconfigured the service. This is why I developed https://cloudsploit.com - to catch these kinds of misconfigurations before they bite you. It's not enough to just have security available you actually have to implement it properly.
[ Parent
| on HN ]
Re:Defense Contractor Left Sensitive Pentagon Files on Unpro...
by FooHentai on Wednesday May 31, 2017 @05:27PM
(#14456076)
You're right that's a huge issue also - And Amazon (to use your example) also takes great pains when engaging with customers to stress that their security competencies and certifications absolutely do not extend to a customer's use of their platforms.
For an obvious example, if Amazon has PCI DSS compliance and a customer comes along and builds a payment gateway on AWS services, that customer is not also PCI DSS compliant by extension.
But this thinking extends to all of the security assertions/certifications/measures that Amazon puts forth.
That is to say, 'we secure the platform but you can absolutely make an insecure mockery of a system on top of that platform'. In all cases you must implement your own security protections and processes on top.