The key findings from the report (“2020 Cloud Misconfigurations Report“) include the statistic that 33 billion records were exposed by cloud misconfigurations during the course of 2018 and 2019 alone. Furthermore, the subsequent data breaches caused by many of these cloud misconfigurations have cost enterprises more than an $5 trillion globally.
Some reasons for cloud misconfiguration, as identified by McAfee, include:
Unrestricted Outbound Access,
Unrestricted Access to Non-HTTP/HTTPS Ports,
Unrestricted Inbound Access on Uncommon Ports,
Unrestricted ICMP Access.
The new data is based on an assessment of each reported data breach over the two year period. The data breaches were evaluated to determine if the primary cause was a cloud misconfiguration. Those incidences attributable to cloud misconfigurations were assessed as part of the research.
To calculate the cost, TechRepublic states that the DivvyCliud researchers took a finding from a 2019 Ponemon Institute report which determined that the average cost per lost record is $150. This was used to extrapolate the total cost of cloud misconfiguration breaches, arriving at the figure of $5 trillion across the two year period.
Further, 2019 saw an increase in terms of financial impact from 2018. The report finds that in 2018, there were a total of 11.8 billion records exposed (costing $1.76 trillion); however, by 2019, that number rose to 21.2 billion exposed records, and the cost increased to $3.18 trillion.
As well as climbing costs, the number of breaches has also been moving upwards. In 2018, 81 major breaches attributed to cloud misconfigurations were reported. By 2019, this number rose to 115, which represents a 42 percent increase.
As to why data breach rates have increased, the report notes there is a correlation with mergers and acquisitions, with many firms failing to execute proper due diligence during mergers, something that can lead to massive security errors. No cloud provider was immune from the breaches, signalling that misconfigurations plague all cloud services. That said, Elasticsearch misconfigurations accounted for 44 percent of the total (by far the largest proportion).
Overall, these trends suggest that companies need a new model of security – one that provides continuous controls and enforces secure configurations of cloud services.
