What AWS users can learn from the Capital One breach

What Capital One did right

Security breaches never cast a favorable light on organizations, especially when information is compromised at the scale of the Capital One hack. But the speed with which Capital One responded has earned the bank some praise.

"Mistakes will be made. It's about how quickly you can recover and respond," said Fernando Montenegro, an information security analyst at 451 Research.

Capital One's response was swift on a number of levels.

The organization initially discovered the breach via a tip sent to Capital One's vulnerability disclosure email inbox. Just 12 days after the email alert, the FBI arrested the alleged hacker. She was later formally charged with wire fraud, as well as computer fraud and abuse. The short timeline between the original report and the FBI arrest suggests that Capital One contacted law enforcement as soon as possible.

Similar to Capital One, organizations should have a breach escalation plan in place so that, in the event of a data leak, time is not wasted deciding the course of action. Set up a plan that details what steps to take and who to contact if a breach is discovered. Consider creating a vulnerability disclosure forum, like Capital One's email inbox, where individuals outside of your organization can report potential threats.

Capital One's team was also quick to determine the source of the hack. They discovered that unauthorized access was obtained through a misconfigured web-application firewall and immediately corrected the misconfiguration. Other organizations on AWS can monitor for misconfigurations within their environments with tools such as AWS Config, CloudTrail and CloudWatch.

In addition to rapid contact with law enforcement and fixing the configuration, Capital One disclosed the details of the incident promptly and thoroughly in a statement on the day of the arrest. The statement exposed the severity of the incident, but it also offered transparency, which could help the bank recover customer trust going forward.

What Capital One did wrong

There were issues within the organization that contributed to the breach. Cloud security experts highlighted two main organizational problems.

First, there was a misconfiguration of a software application that Capital One installed. AWS' shared responsibility model states that customers must secure anything they run in the cloud, which puts the onus of this misconfiguration on Capital One.

Second, Capital One's security team was not aware of unauthorized identities and credentials used to access the AWS Management Console. This lack of awareness allowed the hacker to enter the environment. Organizations that run on AWS should monitor and maintain access control with AWS Identity and Access Management roles and policies.

"You have to know who is accessing the console and what you have in the environment," said Andras Cser, a security analyst at Forrester Research.

Many organizations face issues similar to those of the Capital One and AWS incident because their teams oversee high numbers of workloads.

"People are just too busy and things fall through the cracks," Montenegro said.

Capital One and organizations that want to shore up their defenses against a similar attack need to reassess how security, development and operations teams work together to prioritize data protection.

"For an organization, it is understanding that security responsibility is something that belongs to everybody," Montenegro said. "If you are a cloud developer, security now is your responsibility as well ... the team that is responsible for writing an app is also responsible for running it and is also responsible for securing it."

Cloud security takeaways from Capital One and AWS' ordeal

The Capital One breach is yet another cautionary tale about the need to bolster cloud security. And while it's impossible to entirely eliminate the chance of a breach, organizations can reduce their exposure with the right overarching practices.

Shift the focus of security from reactive to preventative, Cser said. While Capital One's reaction proves it is important to have a recovery plan in place when incidents occur, organizations should prioritize features and services that minimize the attack surface and decrease the likelihood of a breach. A preventive security approach involves encryption, routine vulnerability checks and uniform configurations deployed via a continuous pipeline and automation practices, Cser explained.

Cloud security also depends on the tools organizations choose. "The cloud makes things even less visible and much more concentrated. So you need to have tools that increase visibility and limit the access," Cser said.

A combination of native AWS and third-party tools is best, Cser advised. Pairing AWS security tools with outside options yields multi-layered security. Architectural choices can also boost security. Update your cloud AWS environment to incorporate newer, baked-in security elements to reduce your security team's workload, Montenegro said.

In addition, security teams can take on an advisory role in which they delegate some security practices to other teams, such as development and operations teams, Montenegro suggested. This collaboration creates a stronger security strategy across the organization.

"The role that security [teams] begins to play is much more an advisory, coaching role rather than an actual player in the field," Montenegro said.