Cloud Security Wine

Канал cloudsec начался с доклада на Zero Night 2019 про AWS Security. С тех пор многое поменялось, в том числе вектор развития и интересов первоначального автора канала @ttffdd. Однако интересный материал продолжает появляться и, кажется, что он не должен проходить мимо подписчиков.

Чтобы дать новую жизнь каналу, было принято решение, что он станет побратимом DevSecOps Wine и получит новое название CloudSec Wine. Материал про AWS, Azure, GCP Security будет публиковать @dvyakimov на английском языке дабы осветить как можно больше без временных затрат на разбор и перевод.

Let's go on!

🔸AWS Security Hub launches new automated security controls

Seven new automated security controls, which seem to be things you should generally do.

- S3 buckets should require requests to use Secure Socket Layer
- Amazon SageMaker notebook instances should not have direct internet access
- AWS Database Migration Service -replication instances should not be public
- EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT
- AWS Auto scaling groups associated with a load balancer should use load balancer health checks
- Stopped EC2 instances should be removed after a specified time period
- VPC flow logging should be enabled in all VPCs.

https://aws.amazon.com/ru/about-aws/whats-new/2020/07/aws-security-hub-launches-new-automated-security-controls/

#aws

🔸🔹Сyberark/SkyArk: Detect “shadow admin accounts” in AWS and Azure

Certain (combinations of) seemingly limited cloud permissions can be used by attackers to escalate their privileges. This tool aims to enumerate Azure and AWS accounts with permissions that in reality are quite privileged.

https://github.com/cyberark/SkyArk

#aws #azure

🔸AWS IAM Permissions Guardrails

A collection of SCPs that you can use to protect all accounts under your Organization.

https://aws-samples.github.io/aws-iam-permissions-guardrails/guardrails/scp-guardrails.html

🔸AWS Incident Response

This project explores useful CloudTrail events that support incident response and detection of misconfigurations.

https://github.com/easttimor/aws-incident-response

🔸Amazon Fraud Detector is now Generally Available

“A fully managed service that makes it easy to identify potentially fraudulent online activities such as online payment fraud and the creation of fake accounts.”

https://aws.amazon.com/ru/blogs/aws/amazon-fraud-detector-is-now-generally-available/

#aws

🔹Azure security best practices and patterns

Security best practices to use when designing, deploying, and managing cloud solutions by using Azure.

https://docs.microsoft.com/en-us/azure/security/fundamentals/best-practices-and-patterns

#azure

🔸How to use resource-based policies in the AWS Secrets Manager console to securely access secrets across AWS accounts

AWS Secrets Manager now allows to create and manage resource-based policies using the Secrets Manager console. At the same time, Secrets Manager is now able to identify and prevent creation of resource policies that grant overly broad access to secrets across AWS accounts.


https://aws.amazon.com/ru/blogs/security/how-to-use-resource-based-policies-aws-secrets-manager-console-to-securely-access-secrets-aws-accounts/

#aws

🔸aws-recon

Recon helps build a comprehensive inventory of the security-related metadata in an AWS account. The output is standard JSON, so it can be used in automation pipelines or feed into other tools for further analysis.

https://github.com/darkbitio/aws-recon

#aws

🔸AWS Exposable Resources

Repo maintaining a list of all AWS resources that can be publicly exposed, and eventually, those that can be shared with untrusted accounts.

https://github.com/SummitRoute/aws_exposable_resources

#aws

🔹Moving Windows Server to Microsoft Azure to Enable Compliance

Free e-book discussing how to manage compliance, privacy, and security when migrating Windows Server workloads to Azure.

https://azure.microsoft.com/en-us/resources/moving-windows-server-to-microsoft-azure-to-enable-compliance/

#azure

⚪️ Preventing lateral movement in Google Compute Engine

To implement a defense in depth approach for Compute Engine there are a few things you should do, like isolate your production resources from the internet, disable the use of default service accounts, limit access to service account credentials, use OS Login to manage access to VMs, apply the principle of least-privilege, and collect logs and monitor your system.

https://cloud.google.com/blog/products/identity-security/preventing-lateral-movement-in-google-compute-engine

#gcp

🔸Secure your AWS ECS Microservices with Consul Service Mesh

Blog looking at a Consul service mesh pattern for applications in ECS. This example is running on EC2 instances under an ECS managed cluster, but could be easily modified to run Fargate workloads as well.

https://medium.com/hashicorp-engineering/secure-your-aws-ecs-microservices-with-consul-service-mesh-23df69949754

#aws

🔹 Five Best Practices for Cloud Security

Overview providing a snapshot of five best practices for cloud security: identity and access control, security posture management, apps and data security, threat protection, and network security.

#azure

🔸Using Amazon GuardDuty to Protect Your S3 Buckets

This expands GuardDuty threat detection coverage beyond workloads and AWS accounts to also help you protect your data stored in S3.

https://aws.amazon.com/ru/blogs/aws/new-using-amazon-guardduty-to-protect-your-s3-buckets/?sc_channel=sm&sc_campaign=AWSSecurity_Services&sc_publisher=TWITTER&sc_country=Security&sc_geo=GLOBAL&sc_outcome=adoption&trk=AWSSecurity_Services_TWITTER&linkId=95689196

#aws

⚪️ Introducing CAS: Securing applications with private CAs and certificates

Google announced Certificate Authority Service (CAS), a highly scalable and available service that simplifies and automates the management and deployment of private CAs.

https://cloud.google.com/blog/products/identity-security/introducing-cas-a-cloud-based-managed-ca-for-the-devops-and-iot-world

#gcp

🔸Best Practices for Securing Amazon EMR

This post walks you through some of the principles of Amazon EMR (a managed Hadoop framework) security, including encryption, authentication, and network access.

https://aws.amazon.com/blogs/big-data/best-practices-for-securing-amazon-emr/

#aws

🔸Analyzing IAM Policies at Scale with Parliament

The most efficient and repeatable method for finding misconfigurations in IAM policies and roles is to automate the detection process using existing libraries. This blog explores how the Parliament library can be run to detect if a policy is malformed, identify unknown permissions that do not exist within the platform, and callout resource mismatches when resources and permissions do not apply to each other.

https://blog.scalesec.com/analyzing-iam-policies-at-scale-with-parliament-69ae50d335e

#aws

🔸cr0hn/festin

A tool by Daniel García for discovering open S3 Buckets starting from domains. Collects info via DNS, web pages (crawler), and S3 buckets themselves (like S3 redirections). “Watch mode” can listen for new domains in real time, and supports downloading bucket objects and putting them in Redis Search to enable full-text search of discovered contents.

https://github.com/cr0hn/festin

#aws

🔸SmogCloud: Expose Yourself Without Insecurity - Cloud Breach Patterns

BlackHat Arsenal presentation by Bishop Fox’s Rob Ragan and Oscar Salazar on a new tool: Smogcloud, that can be used to find exposed AWS cloud assets that you may not have known you had.

- For example: Internet-facing FQDNs and IPs across one or hundreds of AWS accounts, assets that are no longer in use, services not currently monitored, shadow IT, etc.
- Currently supports about 13 different AWS services.

https://github.com/BishopFox/smogcloud

#aws

⚪️Compromise any GCP Org Via Cloud API Lateral Movement and Privilege Escalation

Great BlackHat USA / DEF CON Safe Mode talk by Allison Donovan and Dylan Ayrey and tool release, gcploit, a “BFS search tool meant for defensive threat models, a mock org simulator, as well as stack driver queries that profile the gcploit tool.”

https://www.youtube.com/watch?v=Ml09R38jpok

#gcp