Cloud Security Findings
Technical findings mapped to European regulatory requirements
| ID | Finding | Severity | Affected Asset | Cloud Provider | Status |
|---|---|---|---|---|---|
| F-001 | Unencrypted database backup exposed | critical | db-prod-001 | AWS (EU region) | Action required |
| F-002 | Cross-region data replication detected | critical | customer-db-replica | AWS (EU region) | Action required |
| F-003 | Unrestricted service account permissions | critical | service-account-prod-01 | GCP (EU region) | Mitigation in progress |
| F-004 | Logging disabled on regulated workloads | critical | payment-processing-cluster | Azure (EU region) | Action required |
| F-005 | Missing MFA on admin accounts | high | iam-admin-group | Azure (EU region) | Mitigation in progress |
| F-006 | Outdated security patches | high | web-server-05 | GCP (EU region) | Action required |
| F-007 | Missing data residency controls | high | customer-data-db | GCP (EU region) | Action required |
| F-008 | Backup data retained outside policy limits | high | backup-vault-prod | AWS (EU region) | Action required |
| F-009 | Incomplete encryption key rotation | high | kms-key-prod-001 | Azure (EU region) | Mitigation in progress |
| F-010 | Excessive API token lifetime | high | api-service-tokens | GCP (EU region) | Action required |
| F-011 | Public S3 bucket misconfiguration | medium | storage-logs-bucket | AWS (EU region) | Risk addressed |
| F-012 | Weak password policy | medium | user-directory | Azure (EU region) | Mitigation in progress |
| F-013 | Untagged cloud resources | medium | compute-instances | AWS (EU region) | Action required |
| F-014 | Incomplete network segmentation | medium | vpc-prod-network | GCP (EU region) | Mitigation in progress |
| F-015 | Missing security group documentation | medium | security-groups | Azure (EU region) | Action required |
| F-016 | Outdated TLS configuration | medium | load-balancer-prod | AWS (EU region) | Action required |
| F-017 | Incomplete access logs | low | api-gateway-02 | AWS (EU region) | Action required |
| F-018 | Insufficient backup retention | low | backup-policy-001 | Azure (EU region) | Risk addressed |
| F-019 | Missing resource usage alerts | low | monitoring-config | GCP (EU region) | Mitigation in progress |
| F-020 | Incomplete asset inventory | low | cmdb-system | Azure (EU region) | Action required |