Wiz Proposes a Shared Cloud Vulnerability Response Model
Summary
Wiz argues that cloud providers and customers need clearer shared responsibilities, with security benchmarks, threat-model change logs and a cloud vulnerability database to improve transparency and remediation.
Key points
- The author says unclear responsibilities between cloud service providers and customers have hindered remediation of cloud vulnerabilities.
- Examples include AWS sending manual remediation steps for IAM cross-account vulnerabilities and Microsoft notifying selected customers about ChaosDB.
- The article distinguishes provider-managed vulnerabilities from customer-managed vulnerabilities such as Log4j in applications hosted on cloud infrastructure.
- It proposes provider-maintained security benchmarks, threat-model change logs and a cloud vulnerability database with affected-resource details and remediation actions.
- Customers would remain responsible for vulnerability management and applying secure cloud configurations.
Article Details
- Topic
- A proposed shared responsibility model for cloud vulnerability disclosure and response
CVE
Vendors
Amazon Web ServicesOver the past year, the Wiz research team disclosed several critical cloud vulnerabilities such as the AWS IAM cross-account vulnerabilities, ChaosDB, and OMIGOD. In each, there was a startling level of uncertaintyMicrosoftthat didn’t follow the outlined manual steps were left exposed. ChaosDB was disclosed responsibly to Microsoft, which fixed the vulnerability and updated only customers “affected by the research activity”, viaWizOver the past year, the Wiz research team disclosed several critical cloud vulnerabilities such as the AWS IAM cross-account vulnerabilities, ChaosDB, and OMIGOD. In each, there was a startling level of uncertainty
Products
Azuremanaged their advisories through a long list of updates mixed with required actions by customers (AWS and Azure advisories). Customers were expected to read and implement the advisories without any form of tracking.Cosmos DBThe ChaosDB response was to rotate the Cosmos DB cloud keys, but these keys don’t have a “last updated” record.Jupyter NotebooksWhen Jupyter Notebooks were enabled by default by Microsoft, customers had no meaningful way of knowing about their additional exposure or how to preemptively disable the new “feature.”Log4jThe recent Log4j vulnerabilities triggered an unprecedented number of CVE advisories by affected software vendors, while CSPs managed their advisories through a long list of updates mixed with required actions by