A former Amazon employee hacked into Capital One’s systems, running on AWS, and stole the records of 106 million people. And, at first glance, it seems like a classic case of someone outfoxing the security team, who must have been asleep at the wheel.
However, when we take a closer look at how the hacker was actually able to gain access to the Capital One network, we discover that the thief was able to carry out the exploit because someone at Capital One unknowingly misconfigured a firewall, leaving the door wide open. In this sense, the recent Capital One breach was more than a security issue - it was an operational one.
The reality for enterprise IT teams is that the cloud is here to stay since 81% of all enterprises have a multi-cloud strategy. With the operational complexities involved in managing and configuring these environments, IT having plenty of day-to-day fires to put out, and countless systems to configure across a multi-cloud environment, it’s no wonder that mistakes get made.
But it’s also the reason you need a strategy that reins in the complexity and addresses risk. The good news is that IT is aware of the challenge: 66% of IT professionals say security is their most significant concern when adopting an enterprise cloud computing strategy.
The Capital One breach, an exploit of an AWS misconfiguration, underscores just how important it is for IT teams to create consistent, standardized, and repeatable processes for configuring and delivering services across the organization. This is never more apparent than in scaling multi-cloud environments, where configuration of services ad-hoc can quickly become untenable. In a complex cloud world, as Capital One found out the hard way, governance of configurations across the enterprise is king.
One option for IT that can create these repeatable processes—even automate them—is through blueprints. All processes for deployment of new services and resources get encapsulated into a blueprint, allowing IT to deliver multiple, sanctioned services using one method. With automation enforcing compliance when deploying new resources, a breach similar to the Capital One whopper becomes far less likely to happen.
Of course a sound multi-cloud management security strategy calls for more than just automating configuration of resources to prevent error. In fact, it requires a host of security measures, from your choice of antivirus tools and properly configured firewalls, to your processes for managing and implementing patches, to the steps you take to protect your data center from physical threats.
Nevertheless, the cautionary tale of Capital One is a reminder that controlled access to cloud resources is a critical part of this overall strategy. Security isn’t just about having the latest tools, it's also about operations, processes, oversight, and monitoring of everything you do. And with a proactive, strategic mindset on the part of IT, you can lock things down and avoid a high-profile mishap of your own.
