English
Menu

Cyber Attacks and Defense in Practice

It was found that files containing customer information in cloud object storage could be read by anyone on the internet. Which of the following is an appropriate combination of a typical cause of this kind of leak and a measure to prevent recurrence?

  1. AIt was made public through a configuration mistake by the user. Enable a setting that forbids public access across the account and check for configuration mistakes automatically
  2. BThe cloud provider's encryption scheme was weak, and the files were decrypted. Compress the files before storing them
  3. CPhysical security at the cloud provider's data center was insufficient. Station the company's own employees in the data center to keep watch
Show answer and explanation

Answer: A. It was made public through a configuration mistake by the user. Enable a setting that forbids public access across the account and check for configuration mistakes automatically

Under the cloud shared responsibility model, storage access settings are the user's responsibility, and leaks caused by mistakes in public-access settings have happened again and again. Typical mistakes include forgetting to revert a setting made public temporarily for testing, or misunderstanding what a grant applies to and granting access too broadly. As countermeasures, forbidding public access across the account or organization is made the default, and a mechanism that checks the configuration state automatically (CSPM: cloud security posture management) continuously finds and fixes public settings, missing encryption and the like.

  • A. Correct. Configuration mistakes are the typical cause, so forbid public access by default and check the configuration continuously.
  • B. The cause is not weak encryption but a setting that lets anyone read the data. Compression does not protect the contents.
  • C. This is not a case of physical intrusion; the data were read over the internet.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. An access key with administrator privileges allowing all operations (a long-lived credential) was written in a configuration file and given to a batch job running in the cloud. Which of the following is the most appropriate revision to reduce the damage if this key leaks?
  2. An attacker obtained an employee's password and repeated the login dozens of times, flooding the employee's smartphone with notifications asking for approval. The employee got annoyed and pressed "Approve" without thinking. Which of the following is the most appropriate countermeasure to this attack?
  3. Which of the following is the correct reason why authentication with FIDO2 (WebAuthn) passkeys is considered more resistant to phishing than one-time passwords (OTPs)?
  4. A web service saw a large number of login attempts from many different IP addresses, each using a different user's ID and password pair, and some succeeded. Many of the pairs tried matched ones leaked from other services. What is this attack called?
  5. At a cloud email service that uses multi-factor authentication, an employee was lured to a login screen that looked exactly like the real one and entered a password and a one-time password. The attacker used that screen as a relay to the real service, stole the session cookie issued after login and impersonated the employee. Which of the following most appropriately describes this attack and the countermeasures?

Comparisons in this topic