Lohrmann on Cybersecurity

Billions of records are breached each year as a result of misconfigured servers, firewalls and other network devices. What can be done? Let’s explore.

September 21, 2025 • 

Dan Lohrmann

The conventional wisdom is that public- and private-sector enterprises are outgunned, outspent, outmaneuvered and just plain out of their league when it comes to defending themselves online against nation-state hackers and global criminal ransomware groups. And this thinking is not only prevalent in small, poorly funded local governments or midsize U.S. businesses, but even state governments and Fortune 2000 companies often exhibit a defeatist mentality when it comes to cyber defense.

Nevertheless, this thinking ignores (among other things) the reality that a large percentage of data breaches and unauthorized intrusions are a direct result of technology misconfigurations.

“An internal DHS memo obtained by a Freedom of Information Act (FOIA) request and shared with WIRED reveals that from March to May of 2023, a DHS online platform used by the DHS Office of Intelligence and Analysis (I&A) to share sensitive but unclassified intelligence information and investigative leads among the DHS, the FBI, the National Counterterrorism Center, local law enforcement, and intelligence fusion centers across the US was misconfigured, accidentally exposing restricted intelligence information to all users of the platform.

“Access to the data, according to a DHS inquiry described in the memo, was meant to be limited to users of the Homeland Security Information Network’s intelligence section, known as HSIN-Intel. Instead it was set to grant access to ‘everyone,’ exposing the information to HSIN’s tens of thousands of users. The unauthorized users who had access included US government workers focused on fields unrelated to intelligence or law enforcement such as disaster response, as well as private sector contractors and foreign government staff with access to HSIN.”

Here’s an excerpt: “Cybersecurity researcher Jeremiah Fowler, who first discovered and reported the breach, emphasized that instead of being hashed or encrypted, the leak involved plain-text records of sensitive information, making it immediately usable for cybercriminals.

“He further highlighted the presence of authorization URLs in the unsecured database, which in some cases could bypass the traditional password entry process, making it even easier for cybercriminals to gain access to private user accounts.

“In modern cloud environments, what looks like a single misstep is usually the byproduct of complex, fast-moving workflows. For example, take a developer spinning up a new microservice, working in a CI/CD pipeline and deploying infrastructure as code (IaC). The security team might not even see the new environment until it’s live. If the template they used includes overly permissive IAM policies, that misconfiguration automatically spreads to every future deployment.

“And, here’s what most people miss: misconfigurations don’t happen in isolation. They’re often tied to contextual blind spots. A storage bucket open to the public isn’t always dangerous—unless it contains sensitive production data or exposes internal infrastructure paths. But cloud security tools typically flag everything equally, drowning teams in alerts while critical issues get buried.”

I’d like to offer some resources to help in this endeavor to close cloud misconfigurations and related enterprise security vulnerabilities.

“Cloud misconfigurations — the gaps, errors and vulnerabilities that occur when security settings are poorly chosen or neglected entirely — provide adversaries with an easy path to infiltrate the cloud. Multi-cloud environments are complex, and it can be difficult to tell when excessive account permissions are granted, improper public access is configured or other mistakes are made. It can also be difficult to tell when an adversary takes advantage of them. …

“Cloud misconfigurations can occur in different places in the cloud infrastructure and are of different types. Let’s look at some cloud misconfiguration examples.

1. Identity and Access Management (IAM)

2. Data Storage Configuration

3. Networking Configuration

For one more, SecPod offers their “Top 10 Cloud Misconfigurations to Avoid” (with details such as the risk, examples, prevention and automation on each item at their website):

1. “Over Permissive IAM Roles

2. Missing Multi-Factor Authentication (MFA) on Admin Accounts

3. Public Storage Buckets

4. Insecure APIs

5. Misconfigured Security Groups

6. Unprotected CI/CD Secrets

7. Lack of Encryption at Rest and in Transit

8. No Centralized Logging

9. Shadow IT / Unmonitored Accounts

For almost two decades, this blog has emphasized the importance of people, process and technology aspects to cybersecurity and technology success. And yet, there remains a natural tendency to assume that better technology will overcome poor processes and even poor training or staff mistakes.

The reality is that misconfigurations fall into the people and process side of cyber, and there are no shortcuts or easy answers to this challenge.

We must redouble our efforts to build better processes and ensure trained staff have adequate safeguards to ensure any mistakes are found and corrected before they lead to data breaches.

Cybersecurity

Dan Lohrmann

Daniel J. Lohrmann is an internationally recognized cybersecurity leader, technologist, keynote speaker and author.

See More Stories by Dan Lohrmann