{"id":6010,"date":"2021-10-22T11:41:08","date_gmt":"2021-10-22T08:41:08","guid":{"rendered":"https:\/\/blog.eset.ee\/?p=6010"},"modified":"2026-06-14T10:27:00","modified_gmt":"2026-06-14T07:27:00","slug":"plugging-the-holes-how-to-prevent-corporate-data-leaks-in-the-cloud","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2021\/10\/22\/plugging-the-holes-how-to-prevent-corporate-data-leaks-in-the-cloud\/","title":{"rendered":"Plugging the holes: How to prevent corporate data leaks in the cloud"},"content":{"rendered":"

<\/p>\n

Forget shadowy attackers deploying bespoke zero-day exploits from afar. A risk that is far more real<\/a> for organizations as they embark on ambitious digital transformation projects is human error. In fact, \u201cmiscellaneous errors\u201d accounted for 17% of data breaches last year, according to Verizon.<\/a> When it comes to the cloud<\/a>, there\u2019s one particular trend that stands out above all others: misconfiguration. It\u2019s responsible for the leaks of billions of records every year and remains a major threat to corporate security, reputation and bottom line.<\/p>\n

<\/p>\n

<\/p>\n

Mitigating this persistent human-shaped threat will require organizations to focus on gaining better visibility and control of their cloud environments \u2013 using automated tooling where possible.<\/p>\n

<\/p>\n

<\/p>\n

How bad are cloud data leaks?<\/h2>\n

<\/p>\n

<\/p>\n

Digital transformation<\/a> saved many organizations during the pandemic. And now it\u2019s seen as the key to driving success as they exit the global economic crisis. Cloud investments sit at the heart of these projects \u2013 supporting applications and business processes designed to power new customer experiences and operational efficiencies. According to Gartner<\/a>, global spending on public cloud services is forecast to grow 18.4% in 2021 to total nearly $305 billion, and then increase by a further 19% next year.<\/p>\n

<\/p>\n

<\/p>\n

However, this opens the door to human error \u2013 as misconfigurations expose sensitive data to malicious actors. Sometimes these records contain personally identifiable information (PII), such as the leak affecting millions at a Spanish developer of hotel reservation software<\/a> last year. However, sometimes it\u2019s arguably even more sensitive. Just last month it emerged that a classified US terrorist watchlist<\/a> had been exposed to the public internet.READ NEXT: Five tips for keeping your database secure<\/a><\/em><\/em><\/p>\n

<\/p>\n

<\/p>\n

The bad news for organizations is that threat actors are increasingly scanning for these exposed databases. In the past, they\u2019ve been wiped and held to ransom<\/a>, and even targeted with digital web skimming code.<\/a><\/p>\n

<\/p>\n

<\/p>\n

The scale of these leaks is astonishing: an IBM study<\/a> from last year found that over 85% of the 8.5 billion breached records reported in 2019 were due to misconfigured cloud servers and other improperly configured systems. That\u2019s up from less than half in 2018. The figure is likely to keep on rising until organizations take action.<\/p>\n

<\/p>\n

<\/p>\n

What\u2019s the problem?<\/h2>\n

<\/p>\n

<\/p>\n

Gartner predicted<\/a> that by 2020, 95% of cloud security incidents would be the customer\u2019s fault. So who\u2019s to blame? It boils down to a number of factors, including a lack of oversight, poor awareness of policies, an absence of continuous monitoring, and too many cloud APIs and systems to manage. The last is particularly acute as organizations invest in multiple hybrid cloud environments. Estimates suggest<\/a> that 92% of enterprises today have a multi-cloud strategy, while 82% have a hybrid cloud strategy ramping up complexity.<\/p>\n

<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

<\/p>\n

Cloud misconfigurations can take many forms, including:<\/p>\n

<\/p>\n

<\/p>\n