Cloud Summit Canada com Rodrigo Montoro
0 likes495 views
The document discusses the AWS Shared Responsibility Model and highlights security insights derived from analyzing AWS services, including statistics on findings and services covered. It emphasizes the importance of understanding default configurations, managing permissions across accounts, and improving security knowledge within organizations. The author encourages continual learning and adaptation in cloud security practices.
Cloud Summit Canada com Rodrigo Montoro
- 1. The deFAULT truth of AWS Shared Responsibility Model Rodrigo Montoro Head of Threat & Detection Research @spookerlabs
- 2. $ aws --profile Rodrigo Montoro sts get-caller-identity Clavis Segurança da Informação ● Head of Threat & Detection Research at Clavis Security ● Living in Florianópolis (Silicon Island) ● Author of 2 patented technologies (US Patent Office) ● Speaker in different conferences (Brazil,USA,Canada) ● Proud Dad and Husband ● Full Ironman triathlon (2x) ● Crossfit and Powerlifting
- 3. Motivation
- 4. Some numbers(*) about security ‘IN’ the cloud (AWS) Clavis Segurança da Informação ● CSPM Detections (cloudsploit) ○ 460 findings (AWS) ○ 87 services covered (around 29% of services) ● Services with Passrole ○ 330 actions ○ 92 services (around 30.7% of services) ● Detections from Elastic rules ○ 59 detections ○ ~22 services covered (around 7.3% of services) ● Detections from Sigma ○ 31 detections ○ ~20 services covered (around 6.7% of services) * based on my analysis in open source tool and public content
- 5. With some ideas in mind … Clavis Segurança da Informação
- 6. Security Operations Center (SOC) AGENDA 1 AWS ecosystem / Control Plane DeFAULT Design Data Plane 1 1 Cross Account 1 Uncommon Services Conclusions
- 7. 7 Clavis Segurança da Informação AWS Ecosystem / Control Plane
- 8. AWS Shared Responsibility Model Clavis Segurança da Informação
- 9. AWS In Numbers Clavis Segurança da Informação ● Around 13k actions ● 973 Managed policies ● Around 300 Services ● 18 regions ● 5 actions access level Source: https://aws.permissions.cloud/
- 10. How authentication and authorization works Clavis Segurança da Informação
- 11. AWS IAM policy flow analysis Clavis Segurança da Informação
- 12. Management Events Clavis Segurança da Informação
- 13. 13 Clavis Segurança da Informação DeFAULT Design
- 14. How many problems an AWS account start (with an Admin user) ? Clavis Segurança da Informação
- 15. Next let’s add an ec2 instance Clavis Segurança da Informação
- 16. Just to finish a s3 bucket … Clavis Segurança da Informação
- 17. Simple scenario (only 3 services) the "deFAULT problems” Clavis Segurança da Informação
- 18. Some more details Clavis Segurança da Informação ● VPC Endpoint ○ Policy Resource : * ● IAM ○ Managed Policies ■ Resource: * ■ No Conditional ■ No control
- 19. service enumeration is possible by design with account id Clavis Segurança da Informação source: https://www.sidechannel.blog/en/enumerating-services-in-aws-accounts-in-an-anonymous-and-unauthenticated-manner/
- 20. 20 Clavis Segurança da Informação Data Plane
- 21. Data Plane Clavis Segurança da Informação ● S3 buckets data events ● RDS Audit logs ● EKS (Kubernetes)
- 22. S3 buckets Clavis Segurança da Informação
- 23. VPC Flow Logs Clavis Segurança da Informação
- 24. GuardDuty Clavis Segurança da Informação source: https://xmind.app/m/K3fmSB/# Events analyzed are NOT saved. Only the payload saved is the content that triggered the finding.
- 25. 25 Clavis Segurança da Informação Cross Account
- 26. What is Cross Account ? Clavis Segurança da Informação source: https://aws.amazon.com/blogs/security/how-to-audit-cross-account-roles-using-aws-cloudtrail-and-amazon-cloudwatch-events/
- 27. Vendors / Partners Clavis Segurança da Informação ● Splunk history ● ReadOnlyAccess policy
- 28. Splunk history Clavis Segurança da Informação
- 29. ReadOnlyAccess World (1/3) - Unwanted Permissions Clavis Segurança da Informação source: https://www.sidechannel.blog/en/unwanted-permissions-that-may-impact-security-when-using-the-readonlyaccess-policy-in-aws/ ● s3:GetObject ● lambda:GetFunction ● ec2:DescribeInstanceAttribute ● dynamodb:{Query,Scan} ● cloudtrail:LookupEvents
- 30. ReadOnlyAccess World (2/3) - bad use everywhere Clavis Segurança da Informação source: https://www.wiz.io/blog/82-of-companies-unknowingly-give-3rd-parties-access-to-all-their-cloud-data
- 31. ReadOnlyAccess World (3/3) - Sample of products Clavis Segurança da Informação Tenable - https://docs.tenable.com/tenablecs/quick-reference/AWS/Content/QuickReference/SetUpA WSReadOnlyAccess.htm Site24x7 - https://www.site24x7.com/help/aws/enable-aws-account-access.html NewRelic - https://docs.newrelic.com/docs/infrastructure/amazon-integrations/get-started/integrations- managed-policies/ Autocloud - https://docs.autocloud.dev/aws-account DivvyCloud - https://docs.divvycloud.com/docs/policies (some minor denies http://get.divvycloud.com/policies/ReadOnlywithAWSReadOnly.json ) Cloudockit - https://www.cloudockit.com/documentation/aws-create-user-for-cloudockit/ Hava.io - https://docs.hava.io/importing/aws/getting-started-with-aws/read-only-iam-user Cloudcraft - https://help.cloudcraft.co/article/87-connect-aws-account-with-cloudcraft
- 32. 32 Clavis Segurança da Informação Uncommon Services
- 33. What do I consider uncommon ? Clavis Segurança da Informação ● Services without security research related ○ big part of 300 services ○ almost 13000 actions ● Very specific services with only "few" customers
- 34. So what is _REALLY_ uncommon ? How about Identity Center (SSO)? Clavis Segurança da Informação
- 35. Passrole world Clavis Segurança da Informação source: https://twitter.com/noamdahan/status/1349384948998922240
- 36. Appstream 2.0 Edition Clavis Segurança da Informação
- 37. 37 Clavis Segurança da Informação Future & Conclusions
- 38. Future and Conclusions Clavis Segurança da Informação ● Make sure you understand default configurations ● Validate cross account / partners permissions ● Know what you are running ● Find your knowledge gaps ● Keep researching and improving detections ● Make sure you train your team
- 39. Thank you! See you at Sector Rodrigo Montoro @spookerlabs [email protected]