Among the errors developers made included: Embedding hard-coded login credentials in code instead of making them a configuration option on the server the code runs on; using public repositories instead of private repositories; failing to use two-factor or multifactor authentication for email accounts; and/or abandoning repositories instead of deleting them when no longer needed, they wrote, writes Threatpost. 

Matt Walmsley, EMEA Director at Vectra, a San Jose, Calif.-based provider of technology which applies AI to detect and hunt for cyber attackers, notes that, “Administrations that are failing to take basic steps to secure cloud services or apps isn’t a new story – there has been so many instances that have come to light where private data was inadvertently left exposed to the internet. While cloud computing’s instant provisioning and scale are valuable benefits, the cloud service provider’s features and default configurations are constantly in flux. Therefore, administrators must know and adapt what they’re doing and ensure appropriate access controls are in place to protect their data. As no system or person is ever perfect, the ability to monitor, detect and respond to unauthorized or malicious access to cloud services can make the difference between a contained security incident and a full-blown breach like these healthcare providers and their patients now face.”