Learning from cloud attacks to improve Cloud Defenses. Leveraging a CSPM and prioritizing vulnerabilities.

1. Cloud Offense Informs Cloud Defense
Learning from past attacks to improve cloud security
Teri Radichel, CEO | @teriradichel |

2. It Depends...
Can the Cloud
Be “More Secure”?
April 8, 2017 by Teri Radichel

3. (Effective rules!)
Benefits of Cloud Security

4. Would you
let someone
who’s not
trained to
be a doctor
operate on
you?

5. Compliance and Cybersecurity Risk
Compliance = Following Rules Risk Security
Weak and Ineffective Rules Increases Weaker
Broken Rules (Exceptions, Disregarded) Increases Weaker
Misinterpreted Rules (Lack of Training) Increases Weaker
Missing Rules (Security Gaps) Increases Weaker
Good Rules Decreases Better
Followed Rules Decreases Better
Automated Auditing Decreases Better
Automated Remediation (Well Implemented) Decreases Better

6. Security Layers
Networking
Identity & Access Management
Application security
System security
Platform security

7. Architecture
Networking
Identity & Access Management
Application security
System security
Platform security
Data
Access

8. Offense
Informs
Defense

9. What causes cloud
data breaches?

10. #1
Go ahead.
Take my data!

11. Public S3 Buckets

12. Yes, hackers will find your publicly exposed data...
Scanning and Guessing
Logs
Mining DNS records
DNS requests
Databases of public S3 buckets
Monitoring network traffic
Access to query cloud accounts
Application code

13. Tip: You never need a public S3 bucket

14. Monitoring: CloudHealth Secure State by VMware

15. Secure ALL your cloud data and storage!

16. #2
Web applications

17. Web Applications...
The gateway to your cloud account

18. 2nd Sight Lab application pentests include...
Authentication errors Architecture flaws CVEs & CWEs
Authorization errors CSRF Request Smuggling
XSS, all types Misconfigurations Mitre ATT&CK
SSRF CORS flaws MFA Flaws
Open Redirect SQL Injection Local File Inclusion
DNS Rebinding XML Injection File upload/download flaws
Data exposure Code Injection Caching problems
Cryptography flaws Insecure deserialization And More...

19. Server-Side Request Forgery (SSRF)

20. Open Redirect

21. DNS Rebinding

22. IMDSI V2 Finding in CloudHealth Secure State

23. #3
Insecure deployments

25. #4
Too much access

26. Segregation of duties: Who...
Grants access? Changes systems? Audits changes?

27. #5
Lack of effective
monitoring &
remediation

35. for REGION in $(
gcloud compute regions list
--format="value(NAME)")
do
gcloud compute networks subnets update default
--enable-flow-logs --region ${REGION}
done

38. CloudHealth Secure State Auto-Remediation

42. Fixed!

43. Zero-trust networking

45. Secure
State
Query
Language
(SSQL)

46. Creating and enforcing zero trust network
1. Strict access for systems with high privileges
2. Precise network requirements for application
3. Required ports and protocols, ingress and egress
4. Prevent non-compliant network deployments
5. Tag instances with policy name
6. Monitor changes for adherence to policy
7. Auto-remediate unwanted changes

47. Managing cyber risk

49. Better Risk Management
Much more than what we covered today
Understand cybersecurity fundamentals
Ask the right questions; Define your rules
Track compliance, exceptions, and approvals
Generate reports to measure organizational risk
Leverage automation to track and remediate
P.S. This is from my book on Amazon >>>

50. Teri Radichel ~ @teriradichel & @2ndsightlab
CEO, 2nd Sight Lab - Cloud Security Training, Penetration Testing & Assessments
IANS Faculty, AWS Hero, Infragard
Security certifications including GSE and industry awards
Author:
Cybersecurity for Executives in the Age of Cloud
https://medium.com/cloud-security
https://medium.com/cybersecurity-news