Picture the postmortem document six weeks after the disclosure. Outside counsel has finished the timeline, the cyber insurance carrier has finished the subrogation dance, and the cloud architect is reading the document that names the misconfiguration the cloud architect did not have time to fix. The cloud architect had time. The misconfiguration was the public storage bucket set to public for a legitimate reason eight months ago, forgotten when the reason ended, sitting open long enough for the public scanner to find it. The cost in the document is the cost the next misconfiguration will quietly produce.
Here is the working version of the field guide. The shorter version is the part the cloud architect and the security team actually have time to read.
What the misconfiguration usually is
Public storage bucket sits at the top of the list because the public storage bucket shows up in the public scan results anyone can run for free. The shape repeats. A developer sets the bucket to public for the legitimate demo, the demo ends, the bucket stays public because the developer has moved on to the next ticket, and the bucket now contains the customer export being downloaded through the public URL. S3 buckets, Azure blobs, GCS buckets, the storage layer does not matter. The shape repeats across all three.
Broad identity policy sits second because that is the path the escalation runs through. A developer writes the policy with the wildcard for the legitimate convenience, the convenience ends, the policy stays broad because no one narrowed it, and the policy grants production access to any identity that has been compromised. The pattern repeats in IAM roles, in Entra ID app registrations, in GCP service accounts. Least privilege sounds like a slide deck. Least privilege is the audit finding the postmortem will name.
Exposed management port sits third because that is the SSH entry point a Shodan query will quietly surface. A developer opens the port for the legitimate remote access, the access ends, the port stays open because no one audited the firewall rule, and the scan finds the port within weeks. RDP on 3389, SSH on 22, WinRM on 5985, the ports are the ports. The pattern is the same in every cloud.
What the attacker does with it
Data exfiltration comes first. The customer data gets downloaded from the public bucket, sits there for the multi month dwell time the postmortem will quietly describe, and ends up in the secondary attack the postmortem will not name. The cost shows up in the disclosure. The cost the disclosure does not capture is the cost of the customer trust the disclosure burned.
Credential escalation comes second. The compromised identity is used to assume the privileged role, the privileged role grants the production access that was the actual objective, and the move from public bucket to internal control plane happens in hours. The escalation is the moment the breach stops being the misconfiguration the architect can quietly fix and becomes the incident the CISO is named in.
Ransomware deployment comes third. Ransomware drops on every instance reachable through the exposed management port, encrypts the data, posts the ransom note, and the breach disclosure that follows is the disclosure the cloud architect is named in. The pattern is the same one that played out in the Capital One breach, the Codecov leak, the sequence of public bucket to production access the postmortem describes as the standard kill chain.
How to catch the next one
Run a CSPM continuously. Not a quarterly scan. A continuous monitor that catches the public bucket, the broad policy, the exposed port the moment the misconfiguration is created. Wiz, Lacework, Prisma Cloud, the vendors are interchangeable. The point is the continuous part. Operations teams that run a CSPM continuously catch the misconfiguration in the hour a developer creates it. Operations teams that run a quarterly scan catch it in the postmortem.
Set the default to deny. New resource starts private, new policy starts narrow, new port starts closed. Someone has to explicitly open the resource rather than remember to close the resource. The architecture is the one every cloud provider supports natively. Teams that have asked the cloud platform team to flip this default have quietly prevented the misconfiguration the developer would have created by accident.
Audit the public exposure weekly. The audit produces the report of every public resource in the cloud. AWS Config, Azure Policy, GCP Security Command Center, the cloud native query does not need a separate vendor. The audit catches the misconfiguration the CSPM missed, the one a developer created on a Friday afternoon when the CSPM was the system someone quietly turned off. Operations that run the CSPM, set the default to deny, and audit the exposure weekly hold the configuration. Operations that wait for the postmortem do not.
The bottom line
Public bucket, broad policy, exposed port. Data exfiltration, credential escalation, ransomware deployment. CSPM continuous, default deny, weekly audit. Operations that run the three controls hold the configuration. Operations that run none of the three write the next postmortem and pretend the misconfiguration was unusual.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
