AWS Support able to access any S3 object due to permission change

Re:AWS Support able to access any S3 object due to permissio... by ealexhudson on Thursday December 23, 2021 @03:47AM (#29659944)

"Declaring an incident" means there's something to investigate, it didn't mean anything bad has happened: it's detection of a non-conformity. The output of the incident would look similar to what you wrote.

Any time the wrong permissions are assigned and confidentiality is potentially breached, I think you have to have an incident. Arguably in some jurisdictions, it's a legal requirement to ensure you have a near miss not an actual breach.

[ Parent | on HN ]

Re:AWS Support able to access any S3 object due to permissio... by staticassertion on Thursday December 23, 2021 @12:27PM (#29664036)

Exactly. This is something we'll be reviewing in our monthly security review at work, discussing what the impact was, why we were not impacted, and any action items we want to take.

Declaring an incident doesn't mean sending out a breach report or anything particularly dramatic, though I can see how as an outsider it may sound that way.

[ Parent | on HN ]

Re:AWS Support able to access any S3 object due to permissio... by politelemon on Thursday December 23, 2021 @12:58PM (#29664448)

This is partially right. The best way to think of an incident is that it has negatively impacted Confidentiality, Integrity, or Availability (the CIA triad).

An incident does mean something bad has happened, and requires action. An example of an action can be to investigate the impact, or to shut something down, or to patch something.

[ Parent | on HN ]

Re:AWS Support able to access any S3 object due to permissio... by ptcrash on Thursday December 23, 2021 @04:35AM (#29660207)

That's enlightening; thanks. Hopefully the steps forward for determining scope and affected objects is easy

[ Parent | on HN ]