Cloud Attacks: A Live Simulation of Cloud MIsconfiguration Attacks
- 1. CLOUD ATTACKS A Live Simulation of Cloud Misconfiguration Exploits Josh Stella, Co-Founder & CTO Fugue
- 2. #InfoSecWorld AGENDA 1. Overview of cloud misconfiguration risk 2. Live Demo: Cloud misconfiguration exploits in action 3. Actionable steps to secure your cloud environment 4. Q&A
- 3. #InfoSecWorld A MAJOR SECURITY RISK Nearly all successful attacks on cloud services are the result of customer misconfiguration, mismanagement and mistakes. 93%CONCERNED FOR MAJOR SECURITY BREACH DUE TO MISCONFIGURATION “ ⎯ Neil MacDonald, Gartner “
- 4. CLOUD MISCONFIGURATION IS A MAJOR SECURITY RISK 66%IAM 59%SECURITY GROUP RULES 51%OBJECT STORAGE ACCESS POLICIES 42%ENCRYPTION IN TRANSIT DISABLED
- 5. Many dangerous cloud misconfigurations are: • not recognized as misconfigurations by security teams • not considered policy violations by compliance frameworks • exceedingly common in enterprise cloud environments CLOUD MISCONFIGURATION IS OFTEN OVERLOOKED
- 6. Before Cloud 1. Identify your target organization 2. Search for vulnerabilities to exploit HACKER STRATEGY HAS EVOLVED Cloud 1. Identify misconfiguration vulnerabilities 2. Prioritize your target organizations Bad actors use automation to find and exploit cloud misconfiguration
- 7. Before Cloud 1. Network and security teams deliver infrastructure to app teams 2. Network analysis and threat detection tools identify intrusions; human-guided response SECURITY STRATEGY MUST EVOLVE TOO Cloud 1. Developers create their own infrastructure and are empowered to secure it 2. Policy as code validation tools prevent misconfiguration; automated detection and remediation eliminates it Cloud security is a software engineering problem, not a security analysis problem.
- 8. A DEMONSTRATION OF A CLOUD MISCONFIGURATION ATTACK
- 9. ONE Firewall Misconfiguration Causes often include “drift” and orphaned resources THIS MISCONFIGURATION ATTACK IN REVIEW TWO Accessing EC2 instance Causes include unpatched instances containing a vulnerability (often orphaned) THREE Getting IAM role access to S3 Insecure use of IAM and EC2 permissions FOUR Bucket discovery and duplication The danger of a single IAM role with broad permissions
- 10. 1: Monitor all access point configurations • Continuously monitor Security Groups for misconfiguration (e.g. access from 0.0.0.0/0) 2: Apply Principle of Least Permission • Ruthlessly limit IAM roles to business requirements for the app • Use different end points for read and write operations • Eliminate S3 bucket listing in production environments 3: Don’t allow EC2 instances to have IAM roles that allow attaching or replacing role policies KEY TAKEAWAYS AND RECOMMENDATIONS
- 11. 4. Ruthlessly clean up unused cloud resources (especially EC2 instances and S3 buckets) • “Orphaned” resources are common and can contain misconfigurations and unpatched OS or application vulnerabilities 5. Include cloud misconfiguration in penetration testing • Use outside pen testers who understand cloud misconfiguration and how to exploit it 6. Use automated remediation for security-critical cloud resources • Focus first on VPCs, S3 buckets, Security Groups, EC2, and IAM) 7. Use an open source policy as code framework for validating compliance • Open Policy Agent and Rego policy language KEY TAKEAWAYS AND RECOMMENDATIONS
- 12. #InfoSecWorld QUESTIONS? Q&A Resources: Fugue Developer is free forever: www.fugue.co/go Validate Terraform with Regula: https://github.com/fugue/regula Fregot (for working with Rego): https://github.com/fugue/fregot Open Policy Agent: https://www.openpolicyagent.org/
- 13. THANK YOU! Josh Stella, Co-Founder & CTO Fugue