Confidential
Hotels, Hookups and Video Conferencing
A Top 10 Countdown to 2020's Worst Data Breaches
“We Dig Your Cloud”

Meet the Speakers
Eric Kedrosky
Director of Cloud Security
Research & CISO
Sonrai Security
Mitch Ashley
CEO & Managing Analyst
Accelerated Strategies Group

2020 Data Breaches

Misconfigurations

10: Prestige Software

Lessons From Misconfigurations
• Need comprehensive
controls, applied to each
domain
• One technique doesn’t
mean safety
• Block permissions with
policies and constant
monitoring for mistakes

Third-Party

9. Keepnet

Lessons From Third Party Breaches
• Need comprehensive
controls across all
providers
• Checks and audits are
required
• Vendors are targets too
• Continuously maintain
least privilege

Weak Authentication for Data Storage

8. Spotify

Lessons for Weak Authentication
• Be careful trusting old
school network protection
• Protect EVERYTHING with
authentication
• Use proper network
zoning for multi-tier
application stacks

No Authentication for Data Storage

7. BlueKai

Lessons for No Passwords
• Use passwords

Human Error

6. Vertafore

Lessons for Human Error
• Continuously monitor
access
• Get to and maintain least
privilege
• Prevent overprivege

Key and Secret Management

5. WildWorks

Lessons Key and Secret Management
• Multi-factor
authentication is powerful
• Use keys wisely
• Looks for keys and secrets
in code repos and open
storage
• Look for sloppy key
exposure

Overprivilege

4. Cisco

Lessons from Overprivilege
• Define adequate privilege
for each account and
workload
• Compare permissions to
usage and triage to get to
least privileged
• Establish protections for
highly privileged accounts
• Watch out for bad habits
in creating overprivileged
accounts

Insider Threats

3. Shopify

Lessons and Tactics for Insider Attacks
• Highly privileged and “break
glass” accounts must be
supported, but such
accounts must be used
carefully
• Separation of duties for
dangerous activities is vital
• Some security architectures
make separation of duties
tricky; root accounts are
required for some functions

Admin Credentials

2. MobiFriends

Lessons and Tactics for Admin Credentials
• Creating accounts and roles
separate duties
• Remove dormant admin
accounts
• Get to least privilege
• Administrative credentials
are only used for
administrative tasks
• Administrator privileges are
appropriately logged and
continuously monitored

Trial By Fire

1. Zoom

Lessons and Tactics for Security Teams
• Continuous auditing and
reporting
• Integrate teams to shift left
effectively
• Prevent and remediate issues
• Remove blind spots and gaps
from Individual tools

Sonrai can help
Identity and Data Protection
for AWS, Azure, GCP, and
Kubernetes
Identity & data access complexity is a ticking time bomb
in your cloud. Tens of thousands of pieces of compute,
thousands of roles, and a dizzying array of
interdependencies and inheritances. First-generation
security tools miss this as evidenced by so many
breaches.
Sonrai Dig, our enterprise identity and data governance
platform, de-risks your cloud by finding these holes,
helping you fix them, and preventing those problems
from occurring in the first place.

Confidential
Q & A

Confidential
Thank You!
sonraisecurity.com
“We Dig Your Cloud”