Deloitte Breach

[deanwebb]

Short version: They had a generic admin account for their Azure services, someone figured it out, and that someone was working with folks that copied a lot of files.



If you have cloud services, you still have to have good security for those cloud services. I'm losing count of all the cloud leaks that are happening, but that seems to be where the weaknesses are of late. Why worry about breaking through a firewall or an IPS in a corporate datacenter when you can just guess that password for the generic admin account on the cloud setup?

Keep your data local, make a hacker that wants your data get it the hard way and make a hacker that doesn't care about your data in particular skip it because it's hard and he can get that data easier somewhere else.

[ZiPPy]

We use them for auditing our financials, and we are a high profile account.  This should be interesting.

[Dieselboy]

[icecream-guy]

I'm losing count of all the cloud leaks that are happening, but that seems to be where the weaknesses are of late.

Remember clouds don't have walls, they are just pockets of air that hold water like a sponge.
When a cloud leaks, it's called rain.

[deanwebb]

We use them for auditing our financials, and we are a high profile account.  This should be interesting.

Interesting means it starts with a call from Deloitte to your management:



Then your management will do this privately:



But they'll be like this publicly:



Your developers will do this:



Your security guys will do this:



And then do this after they're told they have to help clean up the mess:



And then your developers are all:



And the security guys look at the developers' solution and are like:



So the developers try again and think they have a fix:



The network guys have some thoughts on what the developers are hoping they can do in the datacenter:



Then management looks at the cost of all this:



And all the former employees are doing this as they hear the rumors and read the headlines:



And that, my friends, is what "interesting" means when it comes to a cloud breach.