I read 40 small startups' cloud configs. The same five holes, every time

I run Portcullis. With permission I am sharing the pattern from the last 40 accounts scanned, all companies under ten people.

1. A storage bucket that is public and should not be: 17 of 40
2. A database reachable from the whole internet: 12 of 40
3. An access key older than two years, usually belonging to someone who left: 29 of 40
4. No second factor on the root or owner account: 9 of 40
5. Backups in the same account and region as the thing they back up: 31 of 40

None of this is clever. All of it is a Tuesday afternoon.

Number 5. I am not saying anything. I am only looking at number 5.

number 3 is how i lost a weekend in 2021. contractor's key, still live eighteen months after he left, found in a public repo. rotate them. put it in the calendar

Sixth item from my side of the fence: a staging site with production data and no login. I find one most weeks. Search engines find them too.

For the self-hosters: same list, replace "bucket" with "that one port you opened for a test in 2022".

Can you share how you check number 5 automatically? Mine are in another region but the same account.

Same account is the bigger risk of the two. If the account is taken over or closed, both copies go together. Put one copy with a different provider entirely. It costs a few dollars a month.

did all five in an afternoon after reading this. number 3 found a key from 2023. thanks dmitri