Using Splunk/ELK for auditing AWS/GCP/Azure security posture
1 like253 views
The document discusses cloud security, focusing on auditing the security posture of AWS, GCP, and Azure using the CS Suite tool developed by Rod Soto and José Hernandez. It highlights common cloud vulnerabilities, attack vectors, and the necessity for comprehensive security practices to safeguard against increasing threats. It also outlines the integration of logging and data streaming tools like Splunk/ELK for enhanced cloud security analysis and management.
Using Splunk/ELK for auditing AWS/GCP/Azure security posture
- 1. Using Splunk/ELK for Auditing AWS/GCP/Azure Security Posture By Rod Soto and José Hernandez
- 2. $Whoami José Hernandez Principal Security Researcher at Splunk. He started his professional career at Prolexic Technologies (now Akamai), fighting DDOS attacks against Fortune 100 companies perpetrated by “anonymous” and “lulzsec.” As a engineering co-founder of Zenedge Inc. (acquired by Oracle Inc.), José helped build technologies to fight bots and web-application attacks. He has also built security operation centers and run a public threat-intelligence service. Rod Soto Principal Security Research Engineer at Splunk. Worked at Prolexic Technologies (now Akamai), and Caspida. Cofounder of Hackmiami and Pacific Hackers meetups and conferences. Creator of Kommand && KonTroll / NoQrtr-CTF.
- 3. Security in the Cloud... ● The cloud is prevalent and pervasive in all that we do. ● Cloud providers are not invulnerable and attacks against them affect our lives. ● As cloud adoption expands, there are an increasing number of new technologies and unknowns. ● Cloud security is not an exact translation of inside-the-perimeter security. ● Every provider has its own set of technologies, features, and security items. ● While there are several cloud-security initiatives, it is still an ongoing effort. ● There are a range of emerging tools designed to assess the cloud. We chose CS Suite because it helps analysts assess Azure, AWS, and GCP.
- 4. ...Security in the Cloud
- 5. The Imaginary Line Between Provider And Customer
- 6. The Imaginary Line Is Not That Imaginary… AWS
- 7. Azure
- 8. GCP
- 9. Cloud Attacks Highlights ● Sony (2011): 77M users ● ICloud (2014): The Fappening ● CloudHopper: (2014 - 2016 - )(IBM, Fujitsu, NTT Data, Tata, HP, DXC, Dimension, CSC) ● Ashley Madison: (2015) / AFF (2015/2016) ● Equifax (2017): 143M customers ● HBO (2017): 1.5 TB of data stolen, including unreleased GoT ● Marriott (2018): 327M accounts ● Kubernetes: CVE-2018-1002105 (PrivEsc) ● Yup…2019 Capital One: 100M accounts
- 10. Main Cloud Attack Vectors CSA: "Treacherous 12" 1. Data breaches 2. Insufficient identity, credential, and access management 3. Insecure interfaces and application-programming interfaces (APIs) 4. System vulnerabilities 5. Account hijacking 6. Malicious insiders
- 11. Main Cloud Attack Vectors CSA: Treacherous 12 7. Advanced persistent threats (APTs) 8. Data loss 9. Insufficient due diligence 10. Abuse and nefarious use of cloud services 11. Denial of Service (DoS) 12. Shared technology vulnerabilities
- 12. Main Targets of Cloud Attacks ● Users: ATO, key exfil, phishing ● Providers: AZ, AWS, GCP ● Admins: Like Domain Admin, they have access to all ● Resources: Cryptomining, DDoS for rent ● Data: Everyone's private life and work information ● Third parties Partner or co-tenant gets hacked, actor pivots to your cloud, attacks affecting IdP
- 13. DevOps Attack Surface (CI/CD Pipeline) ● Source code repository: Bitbucket, Beanstalk, Github, Gitlab, SVN, S3 buckets ● CI/CD platform: TravisCI, Jenkins, CircleCI, Gitlab ● Container repository: Docker, Vagrant ● IaaS Provider: Kubernetes flavor, OpenStack (this may also be local in some private, hybrid environments) ● IaC Ansible, Terraform, Chef, Cloudformation
- 14. Main Cloud Attack Surface Segments HTTP, API, web services, web sockets Compute backend, distributed processing CLAN/CWAN Databases SQL/NOSQL Storage (block, object, file) Internet/intranet client
- 15. Can We Create Common Criteria For Cloud Security?
- 16. Common Criteria For Cloud Security 1. Network: External access, VLAN/VWAN, VPN, routing 2. Security: CIA → heavy emphasis in IAM, encryption, and FWs 3. Compute: Artifacts such as virtual machines, containers, apps, microservices 4. Database: SQL, NOSQL 5. Storage: Basically buckets and file type storage (block, object, file) 6. Management: Kubernetes flavor, logging setup, Management access
- 17. Common Criteria for Cloud Security Audits Compute AWS: EC2, Lightsail, Lambda, Elastic Beanstalk, ECS, EKS, Batch, ECR, Kubernetes Azure: Virtual machines (VMs), load balancers, app services, batch, Mesh, disks, Kubernetes GCP: VM Instances, disks, snapshots, images, TPUs, metadata, zones, Kubernetes, "big data"
- 18. Common Criteria for Cloud Security Audits Management AWS: Console, CloudTrail, Config, OpsWorks, Systems Manager, CloudFormation, Kubernetes Azure: Console, Monitor, Advisor, activity log, metrics, manage applications, solutions, Kubernetes GCP: Console, StackDriver, audit logs, cloud tasks
- 19. Common Criteria for Cloud Security Audits Storage AWS: S3, EFS, FSx, S3 Glacier, storage gateway, AWS backup Azure: Data Box, Storage explorer, StorSimple, Data Lake Storage GCP: Bigtable, Buckets, DataStore, FireStore, Filestore, Spanner, Memorystore
- 20. Common Criteria for Cloud Security Audits Security AWS: IAM, Resource Access Manager, Secrets Manager, GuardDuty, AWS SSO, Certificate Manager, Key Management Service, Dir Service, WAF & Shield, Security Hub Azure: Azure AD, Security Center (encryption, FW, WAF, etc.), Azure Vault GCP: Security Command Center, Cloud Identity-Aware Proxy, Access Context Manager, VPC, Binary Authorization, Data Loss Prevention, cryptographic keys, Access Approval, Web Security Scanner
- 21. Common Criteria for Cloud Security Audits Network AWS: VPC, CloudFront, Route53, API Gateway, Direct Connect, AWS App Mesh, AWS Cloud Map, Global Accelerator Azure: Virtual Networks, Load Balancers, DNS zones, CDN, Traffic Manager, ExpressRoutes, IPs, route tables/filters, Virtual WANS, Network Interfaces GCP: Virtual Private Cloud network, Network Services, Hybrid Connectivity, Network Service Tiers, network security
- 22. Common Criteria for Cloud Security Audits Database AWS: RDS, DynamoDB, ElastiCache, Neptune, Amazon Redshift, Amazon QLDB, Amazon DocumentDB Azure: SQL DB, Azure DB for PostGres/MariaDB, Redis, SQL Elastic pools, Cosmos DB GCP: Datastore, BigQuery, MongoDB, PostgreSQL
- 23. Enter Cloud Security Suite One-stop tool for auditing the security posture of AWS/GCP/Azure infrastructure Gathers and presents unified information from the following tools: ● GScout ● Scout2 ● Prowler ● Lynis ● Azure Audit template
- 24. Installation Github https://github.com/SecurityFTW/cs-suite ● We modified the original project to produce output logs that can be ingested by major SIEM frameworks. ● You will need CLI tools, accounts with read privileges, and an API token for authentication, in some cases. ● Your vision may vary, depending on segmented resources and organizational architecture. ● The tool, however, presents a nice report category interface.
- 28. The Challenge Of Getting All These Sources Together... ● Logging in the cloud costs $ and requires time for setup. It is not provided by default (CloudTrail, Stackdriver, Azure Monitor, GCP Stackdriver). ● A log indexing and data streaming pipeline infrastructure (Splunk/ELK) needs to be present. ● Architecture of streaming and storage ● A framework that allows analysis and further knowledge operation (basically SIEM). ● Most of the cloud providers have JSON output. Not all monitoring logs are in JSON file, but enough to get a first comprehensive approach.
- 30. Integration with popular SIEMS Splunk/ELK - Based on the common criteria items we can create knowledge objects that can allow the analyst have a better vision on cloud security resources - Things such as dashboards, reports can help analysts make sense of the onslaught of logs coming from such disparate sources - We can then create alerts, lookups and even SOAR playbooks that can help us automate from the onslaught of logs.
- 31. ELK
- 33. ELK Logstash
- 34. Kibana slide
- 35. Splunk
- 36. SPLUNK
- 38. SPLUNK
- 39. SPLUNK
- 40. Splunk Alerts on Results
- 41. Q&A Thank You! Rod Soto @rodsoto rod@rodsoto.net Jose Hernandez @d1vious josehelps.com