Amazon S3 probably gets a lot of use at your company—the object storage service was one of the first cloud services offered by AWS way back in 2006. Its ease of use, reliability, and scalability have proven incredibly popular over the years. But S3 security isn’t so simple—it’s easy to get wrong and think you got it right. Recent high-profile cloud-based data breaches that involved S3 cannot be chalked up to simple customer mistakes. Rather, advanced cloud misconfiguration attacks exploit S3 buckets that otherwise appear to be configured securely. In this talk, Fugue CTO Josh Stella will dig into the complex layers of S3 security to help you think critically about security for your unique AWS use cases. You’ll understand how other AWS services such as IAM and EC2 can create S3 vulnerabilities you may not be seeing—and how malicious actors exploit them.

1. Building a Highly Secure S3
Bucket
Josh Stella, Co-Founder and CTO, Fugue| Nov. 13,
2020
Building a Highly Secure S3 Bucket

2. Agenda
1. Why Cloud Security is Different (A Brief Overview)
2. A deep Dive into the Security of Amazon S3
3. Q&A
Building a Highly Secure S3 Bucket

3. Cloud Misconfiguration is the #1 Risk
CONCERNED
THEY’VE BEEN
HACKED AND
DON’T KNOW IT
84%
CONCERNED
THEY’RE
VULNERABLE TO
A CLOUD BREACH
92%
MISCONFIGURATI
ON RISK WILL
INCREASE OR
STAY THE SAME
THIS YEAR
76%
”I’m seeing a lot of cloud configuration errors in the real world-
and it’s scaring the hell out of me” -- David Linthicum, InfoWorld
Building a Highly Secure S3 Bucket

4. PRE-CLOUD HACKER
STRATEGY
1. Pick Your Target
2. Find Your Vulnerabilities
How Hacker Strategy Changed with
Cloud CLOUD EXPLOIT STRATEGY
1. Find vulnerabilities
2. Pick your target
“Skilled or well-funded hacker groups are employing automation to discover
and exploit misconfigured cloud assets within hours of their deployment”
--John Breeden II, CSO Online
Building a Highly Secure S3 Bucket

5. DEEP DIVE:
THE SECURITY OF AMAZON S3
Building a Highly Secure S3 Bucket

6. Q&A
Building a Highly Secure S3 Bucket