CISA says SaaS providers in firing line after Commvault zero-day Azure attack

The Cybersecurity and Infrastructure Security Agency (CISA) is warning that SaaS companies are under fire from criminals on the prowl for cloud apps with weak security. Apps with default configurations and elevated permissions are the aim of these attacks, although the US agency did not attribute the activity to a specific …

[fg_swe]

Lock All Of It

...behind a firewall, that only enables your users to access the cloudy stuff.

[Anonymous Coward]

Re: Lock All Of It

The problem is that cloudy stuff is by default not shielded.

Personally I think a cloud provider should be liable if they run unsafe defaults so the customer has to change them first.

It's not hard to default to a secure state where the customer has to willingly opne the door. Starting with the barn doors wide open is not what I'd call "Committed to security" (which is what all of them claim).