Aryon Security, Interview With CEO Ron Arbel

The first thing an attacker needs is a target, so an attack naturally begins with resource discovery. During discovery, the attacker builds and expands a database of resource identifiers. These resources are then checked periodically for exploitable conditions. A resource may be discovered long before an opportunity to exploit it arises.

For nearly a decade, a cloud misconfiguration at Toyota left sensitive vehicle data belonging to approximately 2.15 million customers accessible from the internet. What began as a single configuration mistake in 2013 went undetected until 2023, exposing a fundamental weakness in traditional cloud security: detecting misconfigurations only works when someone is looking. And when Toyota finally investigated, it uncovered additional exposures. The incident raises a critical question for every organization operating in the cloud: Why wait to discover a security risk when you could prevent it from existing in the first place?

A leaked cloud credential is usually treated as a detection problem. Find it, revoke it, rotate it, and move on. But the Volkswagen and Cariad data exposure raises a more important question: why was there a long-lived credential worth stealing in the first place? When a single reusable key can unlock sensitive cloud data, the leak is only part of the problem - the configuration that allowed that key to exist is the other.

On 29 July 2019, Capital One disclosed that an attacker had taken data relating to roughly 106 million people across the United States and Canada. The attacker was Paige Thompson, a former Amazon Web Services engineer, who was arrested the same day and convicted on computer fraud charges in June 2022. The company's settlements reached around $190 million.

Cloud attacks don’t always begin with a vulnerability. Often, they begin with a misconfiguration that gives an attacker a path in. In Part 1 of this series, we look at cloud environments from the attacker’s perspective and break down the three conditions behind many exploitable cloud attack paths: Resource DIscovery, Network Accessibility, and Identity-Based Access.

Your cloud security tools may be working exactly as designed. That’s the problem.

Security teams are still finding and fixing the same misconfigurations over and over. The issue isn’t the tools-it’s a reactive model that detects risk after it already exists. Here are five signs that model has reached its limit.

‍