Website References Object Storage

In this article:

Scoring 3.0 Severity: High
Factor: Application Security

Summary

While object storage offers scalability and accessibility benefits, there are inherent risks, particularly concerning data security. For example, if Access Control Lists (ACLs) aren't effectively implemented, sensitive information can be exposed. Also, poorly configured ACLs can lead to unauthorized access, compromised confidentiality, and data breaches.

The severity in Scoring 3.0 is High. It is based on breach risk and determined by SecurityScorecard based on SecurityScorecard data using ML/AI.

The Rescan Frequency for this issue type is Weekly and the Age-Out/Decay period is 45 days since the last observation date.

What is Object Storage?

Object storage is a way to manage and organize data as distinct units, known as objects. Unlike traditional file systems that organize data in a hierarchical structure with folders and directories, object storage uses a flat address space, called a storage pool, where each object is assigned a unique identifier. Each object contains the actual data, metadata, and a unique identifier. Object storage is commonly used for storing media files, backups, and archives. Amazon S3, Google Cloud storage, and OpenStack Swift are examples of object storage systems.

What are the risks involved with referencing Object Storage?

While object storage offers scalability and accessibility benefits, there are inherent risks, particularly concerning data security. One notable risk is the potential exposure of sensitive information if access control lists (ACLs) are not effectively implemented. Poorly configured ACLs can lead to unauthorized access, compromise confidentiality, and result in data breaches.

What are the Recommendations?

- Implement comprehensive security measures, including ACLs. These help ensure only authorized users have permission to access and change data. 
- Utilize encryption both in transit and at rest to safeguard sensitive information. 
- Regularly audit and monitor access logs to promptly detect any suspicious activity. 
- Implement multi-factor authentication to add an extra layer of security. 
- Educate users and administrators about best practices for securely interacting with object storage systems.

How can the finding(s) be remediated?

SecurityScorecard allows the removal of findings if you have confirmed that the Recommendations above have been followed. The findings can be remediated using either the "Fixed" button or using the "Other Resolution" option after selecting the finding(s).