Amazon Web Services will now scan customer environments for potentially misconfigured servers in the wake of Capital One's data breach. Even though many of these cloud-based data breaches weren't the fault of cloud service providers, many are stepping up to detect problems before they become security incidents.
Financial services organizations and many other enterprises have hesitated to go all in the cloud, citing concerns about depending on a third-party to protect the data, and the Capital One breach may encapsulate their fears. But the fact is, the cloud provides security benefits, so long as proper controls are put in place.
A researcher found that some AWS authentication cookies remain valid for up to 12 hours even after a user has changed the password and logged out.
Amazon's AWS cloud platform now has a security feature that will block all public access to S3 data storage buckets.
A particularly vexing challenge in authentication is finding cases where credentials have been compromised or when login attempts are not legitimate. Netflix has open-sourced an internal tool called Trailblazer that uses AWS CloudTrail to help tackle this challenge in a scalable way.