Misconfiguration

Misconfiguration is the most common root cause of cloud data breaches: a public S3 bucket, an unauthenticated database, an over-privileged IAM role, a Kafka topic without ACLs. The pattern is almost always configuration drift from a secure baseline — a developer opens a port for a one-off test, an engineer broadens an access policy to unblock a release, a vendor spins up a dev tenant with permissive defaults. Each individual change seems small; aggregated across thousands of resources, the risk is substantial.

Cloud Security Posture Management (CSPM) and DSPM tools continuously scan configurations against baselines (CIS Benchmarks, provider best practices, custom policies) and surface violations with evidence. Under GDPR Article 32, DPDP Section 8(5) and PDPA, maintaining a secure baseline configuration is part of 'reasonable security safeguards'. The accountability principle requires evidence that configurations are reviewed on a defined cadence — Infrastructure-as-Code review in CI, automated drift detection, and documented remediation workflows are the audit-grade artefacts.