Supply chain attacks have continued in 2022, although not with the impact or intensity of 2021. This latest attack on teqtivity, a part of Uber’s digital supply chain continues that trend. To date, breaches of cloud services have not relied on the exploitation of vulnerabilities, rather on poor configuration.

It is perhaps telling that teqtivity’s Breach Notification Statement refers directly to the investigation of “logs and server configurations.” While the details of the event are not yet clear, breaches like this continue to serve as reminders that security must be an integral part of cloud policies and the CI/CD pipeline, ensuring that workloads and services do not go live in weak or exploitable states, and that sensitive data is adequately protected with a combination of both encryption and effective application of the principles of need-to-know and least privilege – and yes, that includes backups.