Revealing Choke Points - Practical Tactics for Boosting Cloud Security
Download as PPTX, PDF0 likes78 views
The document discusses the concepts of threats, high-value targets (HVTs), attack vectors, and choke points in the context of cybersecurity, specifically in cloud environments. It defines threats as potential causes of incidents that can harm systems and organizations, while HVTs are critical personnel or resources that, if compromised, can lead to significant risks. Furthermore, it explores attack vectors as methods used by cyber attackers to compromise systems and emphasizes the importance of managing permissions through AWS Identity and Access Management (IAM).
Revealing Choke Points - Practical Tactics for Boosting Cloud Security
- 1. Filipi Pires Director of Threat Researcher and Cybersecurity Advocate 1 Choke Points: Practical Tactics for Boosting Cloud Security
- 2. Director of Threat Researcher and Security Advocate Advocate Opensource/Community Instructor, Writer and Reviewer #WHOAMI
- 4. # What is a Threat??? According to ISO 27005, a threat is defined as a potential cause of an incident that may cause harm to systems and organization. • Software attacks • Theft of intellectual property • Identity theft • Sabotage • Information extortion are examples of information security threats.
- 6. # HTV – High-Value Target In United States military terminology, a High-Value Target (HVT) is the term given to a person or resource that an enemy commander requires to complete a mission. Which of your organization's staff members can provide access to critically important information/systems and, if compromised, could become a single point of failure? Who are the ones that pose a high-impact risk if an attack against them is successful? Source:https://www.xmcyber.com/blog/attack-path-vs-attack-vector-important-differences-you-need-to-know/
- 7. HVTs are usually individuals in the C-Suite, board members, senior executive management personnel, executive assistants, teams, or people with elevated privileges regarding information and organizational assets (including technological assets). Other times, they are teams of people working on sensitive or high-stake projects. Individuals may also turn into an HVT over a relatively short, specific period of time if, during that time, they get to engage in a critical project for the organization Source:https://www.xmcyber.com/blog/attack-path-vs-attack-vector-important-differences-you-need-to-know/ # HTV – High-Value Target
- 9. # Attack Vector An attack vector is a method that cyber-attackers use to compromise a system. Although the terms are sometimes mixed, attack vectors are not to be confused with an attack surface, which is best defined as every possible point where an adversary can attempt to gain entry into your network or system.
- 10. Malware, ransomware or phishing are all examples of common attack vectors. Some of the human errors that help create attack vectors include: • Having weak credentials • Using ”poor“ encryption • Misconfigurations • Allowing access to sensitive information via privilege escalation # Attack Vector
- 11. # Attack Path An attack path is a visualization of the chain of events that occurs when attack vectors are exploited. In this sense, an attack vector acts as a doorway, while an attack path is a map that shows how an adversary entered the door and where that adversary went. https://owasp.org/www-project-top-ten/2017/Application_Security_Risks
- 12. Choke Points
- 13. # Choke Points In cloud security, a choke point is a strategic location where multiple attack paths converge before reaching critical assets. These assets could include cloud resources, endpoints, files, or folders that attackers may target to advance toward more valuable objectives.
- 14. AWS IAM
- 15. # AWS IAM AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. With IAM, you can centrally manage permissions that control which AWS resources users can access. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources. Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html
- 16. Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html # AWS IAM
- 17. Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html # AWS IAM
- 19. # AWS Attack
- 20. # AWS Attack
- 21. # AWS Attack
- 22. # AWS Attack
- 23. # AWS Attack
- 24. # AWS Attack
- 25. # AWS Attack
- 26. # AWS Attack – Create Policy Version
- 27. 27 # AWS Attack – AWSPX Source: https://github.com/WithSecureLabs/awspx
- 28. How can senhasegura help the community? 28
- 29. Filipi Pires Director of Threat Researcher and Cybersecurity Advocate
- 30. Demo