Medusa and the Ransomware Playbook of 2025
March 14, 2025Before the Alarm: Building an Incident Response Plan That Works
March 31, 2025Cloud breaches rarely stem from a broken hyperscaler. Through the first half of 2025, the recurring story remained the same: exposed storage buckets, overly permissive identity policies, forgotten test environments, and secrets committed to code. The cloud did what it was told. It was told the wrong thing.
The shared responsibility misunderstanding
Providers secure the infrastructure; customers secure what they build on it. Many organizations, especially those that migrated quickly, never fully absorbed where that line sits. Automated tools sweep the internet for open buckets and exposed management interfaces within minutes of their appearing.
Where things go wrong
- Identity sprawl. Roles and access keys accumulate broad permissions that are never trimmed.
- Public by accident. Storage and databases left open to the internet, often in forgotten projects.
- Leaked secrets. API keys and credentials embedded in repositories, container images, or logs.
- No baseline. Environments built by hand with no consistent, reviewed configuration.
Getting control
Start with visibility, inventorying your cloud footprint across every business unit and shadow project. Enable the provider’s native security posture tooling. Attack identity next: enforce least privilege, prefer short-lived credentials over long-lived keys, require multi-factor authentication on all console access, and eliminate hardcoded secrets in favor of a managed secrets service. Turn on logging across accounts and retain it centrally.
Takeaway
Most cloud incidents are self-inflicted through misconfiguration, not clever exploits. Inventory everything you run, close public exposure, enforce least privilege and short-lived credentials, kill hardcoded secrets, and turn on logging everywhere so you can both prevent and reconstruct.