Home > Categories > Governance, Risk and Compliance > Twilio Breach and Cloud Security

Software Category

Governance, Risk and Compliance

Write Review

Twilio Breach and Cloud Security

By exploiting a five-year-old configuration error, a hacker was able to access Amazon’s S3 cloud storage buckets on which Twilio’s code was loaded. As a result, customers were able to unknowingly download the modified code for twenty-four hours.

Airbnb, Netflix, Twitter, Uber, and Shopify are just some of Twilio’s customers who integrate its voice and text capabilities into their platforms. The impact of the modified code was to display malicious ads on consumers’ browsers, and it seems to have been part of a larger hack, searching for vulnerabilities on the Amazon platform.

According to an IT World Canada article, 99% of cloud breaches are the result of configuration errors.

Our Take

In reading the article, two thoughts came to mind: governance/oversight and response capability. Anyone whose been in the trenches for any length of time knows that when outsourcing any part of your business, and especially IT, whether through cloud or managed services, you must consider the skills and staffing needed to properly oversee the quality and integrity of your service. In fact, you must even consider how your teams’ skills will remain fresh and current to ensure the oversight is of sufficient quality to protect your business.

You can never outsource accountability. Just because a big name like Amazon is attached to your solution does not mean that the implementation will meet expectations. Consider asking yourself, do you have a checklist of requirements, standards, test methodology, and ongoing validation that the environment is configured properly? Is your managed services vendor really providing the services that you believe you contracted them to provide? Finally, do you have alert and response capabilities that meet the risk and customer expectations. In Twilio’s case, it took eight hours following notification to reverse the configuration error. The more interconnected we become, the more we need clear delegations of responsibility and oversight as well as response plans for the inevitable.

Review your cloud strategy in detail. To understand the number of cloud sites accessed by your company, consider investigating cloud access security brokers.

Other Recent Research in Governance, Risk and Compliance

Governance, Risk and Compliance

Qualys and Ivanti Partnership Boasts an Incredibly Robust Vulnerability Management Platform

Qualys VMDR and Ivanti have announced a new partnership dedicated to improving the detection and patching of vulnerabilities. Announced July 30, the Qualys and Ivanti Partnership have already gone live as an integrated component of the VMDR solution.

Governance, Risk and Compliance

IBM Raises Price on Software Support; Shoves Customers Toward the Cloud

IBM is changing the terms of its ubiquitous Passport Advantage agreement to remove entitled discounts on over 5,000 on-premises software products, resulting in an immediate price increase for IBM Software & Support (S&S) across its vast customer landscape.

Governance, Risk and Compliance

RiskSense Releases a Unified Infrastructure Security Risk Management Program

RiskSense announced on July 13 its new version of the cloud-delivered RiskSense risk management platform. The main draw of the program is its holistic risk calculation across CVEs and CWEs.