Misconfiguration is the biggest cloud risk—not sophisticated attacks, but mistakes. Public storage buckets, excessive permissions, missing MFA, and default settings cause most cloud breaches. Cloud providers secure infrastructure; you secure configuration.
Quick answer: Misconfiguration is the biggest cloud risk—not sophisticated attacks, but mistakes. Public storage buckets, excessive permissions, missing MFA, and default settings cause most cloud breaches. Cloud providers secure infrastructure; you secure configuration.
The Shared Responsibility Problem
Cloud provider responsibility:
- Physical data centres
- Network infrastructure
- Hypervisor/platform
- Physical security
- Configuration
- Access control
- Data
- Applications
- Identity management
Top Cloud Misconfigurations
1. Public storage
The risk: S3 buckets, Azure Blob storage, or Google Cloud Storage accidentally left public. Anyone can access your data.
How it happens:
- Default "public" in some contexts
- Developer convenience during testing
- Misunderstood permission models
- Legacy configurations not reviewed
- Millions of customer records exposed
- Backup files publicly accessible
- Database exports downloadable
- Block public access at account level
- Regular audits of storage permissions
- Automated scanning for public resources
- Clear policies on storage configuration
2. Excessive permissions
The risk: Users and applications with more access than needed. Compromised account = excessive blast radius.
How it happens:
- "Just give them admin to fix the problem"
- Permissions granted, never reviewed
- Service accounts with broad access
- Role inheritance not understood
- Least privilege principle
- Regular access reviews
- Just-in-time access for admin
- Service account audits
3. Missing or weak authentication
The risk: Cloud admin consoles without MFA. Root accounts used directly. Weak passwords on service accounts.
How it happens:
- Speed prioritised over security
- "We'll add MFA later"
- Service accounts can't use MFA (but can use other controls)
- Root accounts not properly secured
- MFA on all human accounts
- Root account locked down (alerts on use)
- Strong credential management for service accounts
- Conditional Access policies
4. Insecure defaults
The risk: Cloud services launch with insecure default configurations. Nobody changes them.
Examples:
- Wide-open security groups
- Encryption disabled by default
- Logging not enabled
- Public IP addresses auto-assigned
- Baseline hardening standards
- Infrastructure as code with security built in
- Configuration scanning
- Compliance checks before production
5. Logging and monitoring gaps
The risk: No visibility into what's happening. Breaches undetected for months.
How it happens:
- Logging not enabled
- Logs not retained
- Logs not monitored
- Alerts not configured
- Enable logging everywhere
- Centralise logs
- Retention matching compliance needs
- Monitoring and alerting active
6. Network exposure
The risk: Management ports exposed to internet. Security groups too permissive. Network segmentation missing.
How it happens:
- SSH/RDP open for troubleshooting
- Overly permissive firewall rules
- Everything in one network segment
- Legacy rules never cleaned up
- No management access from internet
- Least-privilege network rules
- Network segmentation
- Regular rule review
Cloud Security Posture Management (CSPM)
What it is: Tools that continuously assess cloud configuration against security best practices.
What it does:
- Scans cloud environments
- Identifies misconfigurations
- Prioritises by risk
- Provides remediation guidance
- Tracks compliance over time
- Microsoft Defender for Cloud
- AWS Security Hub
- Prisma Cloud
- Wiz
Microsoft 365 Specific Risks
Even "simple" cloud like M365 has configuration risks:
- SharePoint oversharing
- External sharing too permissive
- Guest access not controlled
- DLP not configured
- Conditional Access missing
- Admin accounts not protected
How We Help
For managed clients:
Microsoft 365:
- Security configuration baseline
- Secure Score improvement
- Ongoing configuration management
- Regular reviews
- Configuration assessment
- Remediation support
- CSPM implementation
- Ongoing monitoring
---
about configuration assessment.
---