SEC510: Cloud Security Controls and Mitigations

Overview

SEC510 starts with a brief overview cloud breach trends, exploring why the vast majority of breaches are now happening in the cloud. We will explore how multicloud makes security harder, why organizations are going multicloud, and how both standardization and cloud agnosticism cannot solve the problem alone. We introduce three of the frameworks we will use throughout the course to implement attack-driven controls and mitigations: the MITRE ATT&CK Cloud Matrix, the Center for Internet Security (CIS) Cloud Foundational Benchmarks, and the Cyber Defense Matrix. Students will then initialize their lab environment and deploy a modern web application to each of the Big 3 providers.

This leads into an analysis of one of the most fundamental and misunderstood concepts in cloud security: Identity and Access Management (IAM). This module will ensure that all students have a foundation of IAM knowledge on which the rest of the section is built. It covers the goals fulfilled by properly provisioning access, each cloud's IAM service (AWS IAM, Microsoft Entra ID, and Google Cloud Identity), and the various types of access control provided by each.

The next module shifts the discussion from human identities to machine identities. Students will learn how workloads running on AWS Elastic Compute Cloud (EC2), Azure Virtual Machines (VMs), and the Google Cloud Compute Engine (GCE) are given temporary IAM credentials. They will then compromise real IAM credentials from their cloud virtual machines using the Instance Metadata Service (IMDS) to examine firsthand how an attacker can abuse them to access sensitive cloud data and consume cloud resources.

With this foundation, students will discuss the primary vulnerability caused by granting permissions improperly: Broken Access Control (BAC). They will learn how to detect improper access and implement better permissions using a variety of tools. They will learn about the cloud-native tools designed for this purpose: the AWS IAM Access Analyzer, Microsoft Entra ID Permissions Management, and Google Cloud IAM Policy Intelligence. They will also explore how Large Language Models (LLMs) and Generative AI (GenAI) can augment this analysis. These strategies are critical to prevent a minor vulnerability from becoming front-page news.

The section concludes by discussing a critical way that attackers can obtain improper permissions: Privilege Escalation. They will examine the many escalation paths that are available by default in each cloud provider. By implementing policy guardrails, they will drastically minimize the likelihood of privilege escalation being effective.

Exercises

• IAM Fundamentals
• Virtual Machine Credential Exposure
• Broken Access Control and Policy Analysis
• IAM Privilege Escalation
• Bonus Challenges (Section 1)

Topics

• Introduction
  • Cloud Breach Trends
  • Insecure Defaults
  • Multicloud Considerations
  • Shadow Cloud Accounts
  • Cloud Procurement Through Mergers and Acquisitions
  • Standardization and Cloud Agnosticism
  • MITRE ATT&CK Cloud Matrix
  • Center for Internet Security (CIS) Cloud Foundations Benchmarks
  • Cyber Defense Matrix
  • Lab Environment Introduction
  • HashiCorp Terraform Overview
• Cloud Identity and Access Management (IAM)
  • AWS IAM
  • Microsoft Entra ID
  • Google Cloud Identity
  • Identity-Based Policies
  • Resource-Based Policies
  • Attribute-Based Access Control
  • Built-In vs. Custom Policies and Roles
  • AWS Organization Service Control Policy (SCP)
  • AWS Permissions Boundaries
  • AWS Session Policy
  • Azure Role-Based Access Control (RBAC)
  • Google Cloud Allow Policy
  • Google Cloud Deny Policy
• Cloud Managed Identity and Metadata Services
  • Cloud Compute Services
  • Machine Identities
  • AWS Elastic Compute Cloud (EC2)
  • AWS IAM Roles
  • AWS Instance Profiles
  • Azure Virtual Machines (VMs)
  • Azure Managed Identity
  • Google Cloud Compute Engine (GCE)
  • Google Cloud Service Accounts
  • Instance Metadata Services (IMDS)
  • IMDS Exploits
  • Server-Side Request Forgery
  • Command Injection
  • IMDS Hardening
• Broken Access Control and Policy Analysis
  • Exploiting Built-In Policies and Roles
  • Cloud Resource Hijacking
  • Using Custom Policies to Meet Business Requirements
  • Finding Broken Access Control
  • AWS IAM Access Analyzer
  • Microsoft Entra ID Permissions Management
  • Google Cloud IAM Policy Intelligence
  • Large Language Model (LLM) and Generative AI (GenAI) Overview
  • Using Large Language Models (LLMs) for IAM Policy Analysis
  • Effective and Ineffective Use-Case for Applying LLMs to Security
  • Broken Access Control via LLM Hallucinations
• IAM Privilege Escalation
  • IAM Permission Editor
  • Transitive Identity Impersonation
  • Dangerous Built-In Policies and Roles
  • Default Machine Identity Permissions
  • Preventing Privilege Escalation
  • Policy Guardrails

Overview

Section 2 covers how to lock down infrastructure and data using virtual private network controls. As the public cloud IP address blocks are well known and default network security is often lax, millions of sensitive assets are unnecessarily accessible to the public Internet. This section will ensure that none of these assets belong to your organization.

It begins by demonstrating how ingress and egress traffic can be restricted within each provider. Students will analyze the damage that can be done without these controls using examples like accessing a public-facing database containing sensitive information. They will then eliminate unnecessary ingress traffic with secure cloud configuration.

The next module dives deeper into protecting virtual machines running in the cloud Infrastructure as a Service (IaaS) platforms. It begins by showing how public IP addresses, administrative ports, and Serial Console services can be removed while allowing for secure administration via the AWS Systems Manager (SSM) Session Manager, Azure Bastion, Google Cloud OS Login, and the Google Cloud Identity-Aware Proxy (IAP). These techniques allow an organization to work effectively while keeping internal systems off the public internet. Then, it covers how VMs that must expose an HTTP(S) server can be protected with Cloud Application Load Balancers (ALBs) and built-in Web Application Firewall (WAF) services.

With our infrastructure locked down, we pivot to preventing untrusted networks from accessing our Platform as a Service (PaaS) platforms using Private Endpoints. We will demonstrate how defenders can use these endpoints to restrict data access to internal networks. This topic is critical as an organization's most sensitive data is often stored in PaaS instead of IaaS.

While private endpoints enable powerful protections, they can also be abused. Specifically, AWS Private Endpoints with improperly configured Endpoint Policies can be used to perform Remote Code Execution (RCE) in and data exfiltration from isolated networks without internet access. Students will use a malicious payload to exfiltrate data from a target's AWS account to an attacker's AWS account. They will then fix the Endpoint Policy to prevent this attack vector.

The section concludes by covering how to enable cloud-based network analysis capabilities to address malicious traffic on network channels that cannot be blocked. Students will analyze cloud flow logs and search for indicators of compromise. This module covers flow logging solutions in all three cloud, Google Cloud Firewall Rules logging, AWS Traffic Mirroring, and Google Cloud Packet Mirroring. Many of these topics have associated Bonus Challenges.

Exercises

• Control Ingress Traffic
• Protecting Public Virtual Machines
• Control Egress Traffic with Private Endpoints
• Remote Code Execution via Private Endpoint Abuse
• Bonus Challenges (Section 2)

Topics

• Cloud Virtual Networks
  • Network Service Scanning
  • Default Network Configuration
  • Internet Gateways
  • NAT Gateways
  • AWS Security Groups
  • AWS NACLs
  • Azure Network Security Groups
  • Google Cloud Firewall Rules
• Protecting Public Virtual Machines
  • Eliminate Public IP Addresses
  • Block SSH and RDP Administrative Access
  • Disable Serial Console Debug Access
  • AWS Systems Manager (SSM) Session Manager
  • Azure Bastion
  • Google Cloud OS Login
  • Google Cloud Identity-Aware Proxy (IAP)
  • Cloud Application Load Balancers (ALBs)
  • Built-In Web Application Firewall (WAF) Services
• Private Endpoint Security
  • AWS PrivateLink
  • Azure Private Link
  • Google Cloud Private Google Access
  • Google Cloud VPC Service Controls
  • Custom Service Endpoints
  • Supply-Chain Attacks via Software Packages
  • Remote Code Execution (RCE)
• Private Endpoint Abuse
  • AWS Private Endpoint Policy
  • Remote Code Execution Without Internet Access
  • Malicious Payload Delivery via S3 and Private Endpoints
  • Data Exfiltration via AWS CloudTrail
• Enabling Traffic Monitoring
  • Flow Logging
  • Google Cloud Firewall Rules Logging
  • AWS Traffic Mirroring
  • Google Cloud Packet Mirroring

Overview

Data security is as important, if not more important, in the cloud than it is on-premises. There are countless cloud data leaks that could have been prevented with the appropriate controls. This section examines the cloud services that enable data encryption, secure storage, ransomware protection, access control, data loss detection, policy enforcement, and more.

The first half of Section 3 covers all you need to know about encryption in the cloud. Students will learn about each provider's cryptographic key management solution and how it can be used to apply multiple layers of encryption at rest. Students will also learn how in-transit encryption is performed throughout the cloud, such as the encryption between clients, load balancers, applications, and database servers. These techniques will improve your organization's security while satisfying its legal and compliance needs.

The second half of Section 3 is primarily focused on cloud storage services. After briefly discussing the most basic storage security technique, turning off public access, it will cover more advanced controls like organization-wide access control, ransomware mitigations, file versioning, data retention, and more. It concludes with a discussion of additional data exfiltration paths and how to automatically detect sensitive data storage.

Exercises

• Detect and Prevent Improper Key Usage
• Encrypt All The Things!
• Recover From Ransomware
• Sensitive Data Detection and Exfiltration
• Bonus Challenges (Section 3)

Topics

• Cryptographic Key Management
  • AWS KMS
  • Azure Key Vault
  • Google Cloud KMS
  • Overview of Single-Tenant Alternatives: AWS CloudHSM, Azure Dedicated HSM, Azure Key Vault Managed HSM, and Google Cloud Bare Metal (Rack) HSM
  • Key Usage Audit Logging
• Encryption with Cloud Services
  • Disk-Level Encryption
  • Service-Level Encryption
  • Column-Level Encryption
  • In-Transit Encryption
  • Enforcing Encryption Consistently Across Cloud Services
• Cloud Storage Platforms
  • Access Control
  • Ransomware Prevention and Recovery
  • Audit Logs
  • Data Retention
  • Supply-Chain Attacks via Developer Tools
• Sensitive Data Exfiltration
  • Data Exfiltration Paths
  • Signed URLs
• Sensitive Data Detection
  • Amazon Macie
  • Amazon CloudWatch Logs Data Protection
  • Overview of Microsoft Purview and Azure Information Protection
  • Google Cloud Data Loss Prevention / Sensitive Data Protection

Overview

This section teaches students how to secure the infrastructure powering their cloud-based applications and how to protect the users of those applications. It begins with a computing paradigm taking the industry by storm: serverless Functions as a-Service (FaaS). It balances the discussion of the challenges serverless introduces with the advantages it provides in securing product development and security operations. After introspecting the serverless runtime environments using Serverless Prey (an open-source tool written by the course authors), students will examine and harden practical serverless functions in a real environment.

The next module covers how Customer Identity and Access Management (CIAM) can help track and authenticate the users of an organization's applications. It does a deep dive into AWS's CIAM solution, Amazon Cognito, and how its default configuration can be exploited to perform user enumeration and account takeover attacks. It also shows how users in Cognito User Pools can obtain dangerous AWS IAM permissions using Cognito Identity Pools. Most importantly, it will demonstrate how these attacks can be prevented.

This section also covers Google Cloud's CIAM solution, Google Cloud Identity for Customers and Partners (CICP). Google Cloud obtained this service through their acquisition of a company named Firebase. The section concludes with a detailed breakdown of this CIAM and its interplay with Firebase's flagship products, the Realtime Database and Cloud Firestore. These highly popular but rarely reviewed services are serverless databases with many access control considerations and security implications for Google Cloud projects.

Exercises

• Serverless Prey
• Harden Serverless Functions
• Using and Exploiting CIAM
• Broken Firebase Database Access Control
• Bonus Challenges (Section 4)

Topics

• Cloud Serverless Functions
  • AWS Lambda
  • Azure Functions and the Azure App Service
  • Google Cloud Functions / Google Cloud Run Functions
  • Security Advantages and Concerns for Serverless
  • Function as a Service Controls
  • Persistence with Serverless
• Cloud Customer Identity and Access Management (CIAM)
  • Overview of OAuth 2.0, OpenID Connect (OIDC), and SAML
  • Amazon Cognito User Pools
  • User Enumeration Attacks
  • Amazon Cognito User Account Takeover Attacks
  • Amazon Cognito Identity Pools
  • Amazon Cognito AWS IAM Broken Access Control
  • Google Cloud Identity for Customers and Partners
  • Firebase Authentication
• Firebase Databases and Google Cloud Implications
  • Firebase Realtime Database
  • Cloud Firestore
  • Google Cloud Privilege Escalation via Firebase
  • Compliance Concerns

Overview

The course concludes with practical guidance on how to operate an organization across multiple cloud providers. Many of the topics discussed in the course become more complicated if an organization's cloud providers are integrated with one another. We begin by discussing how multicloud integration impacts Identity and Access Management (IAM). Many organizations use long-lived credentials to support multicloud integrations. These credentials are much more valuable to attackers than those that are short-lived. Although students will learn best practices for long-lived credentials, this will only mitigate the risk, not eliminate it. This module goes one step further by demonstrating novel ways to use Workload Identity Federation to authenticate from one cloud provider to another with short-lived cloud credentials.

The next module covers the cloud-native Cloud Security Posture Management (CSPM) services. Students will use these services to automate security checks for the CIS Benchmarks covered throughout the course. With these capabilities, an organization can take the lessons learned in SEC510 and apply them at scale.

The final module ties these two topics together. Most organizations would prefer to use a single platform to secure all of their clouds. This requires a vendor to have access to the organization's cloud accounts. Organizations should distrust external services at least as much, if not more so, than their internal systems and users. This module provides the key requirements for minimizing the level of trust vested in these vendors and reducing the risk that this trust is abused. Students will explore this topic by using Multicloud CSPM services as an example. Specifically, they will learn about Microsoft Defender for Cloud's cross-cloud CSPM capabilities. They will analyze a case study of a critical vulnerability in Microsoft Defender for Cloud, discovered by the authors of this course, that could be used to access sensitive data in an organization's linked AWS accounts. Finally, they will implement mitigations to prevent similar types of exploits from being performed via third-party cloud vendors.

Exercises

• Secure Multicloud Integration
• Automated Benchmarking
• Prevent Cross-Cloud Confused Deputy
• Bonus Challenges (Section 5)

Topics

• Multicloud Access Management
  • Risks of Long-Lived Credentials
  • Workload Identity Federation
  • Cross-Cloud Authentication Without Long-Lived Credentials
• Cloud Security Posture Management
  • AWS Security Hub
  • Microsoft Defender for Cloud
  • Google Cloud Security Command Center
• Vendor Integration and Multicloud Security Posture Management
  • Third-Party Multicloud Security Posture Management
  • Vendor Integration Assessment Criteria
  • Microsoft Defender for Cloud's Cross-Cloud CSPM Capabilities
  • The Confused Deputy Problem
  • Confused Deputy Vulnerability in Microsoft Defender for Cloud
  • Mitigating Cross-Customer Broken Access Control via Cloud Vendors
  • Denying Excessive Permissions to Cloud Vendors
• Summary
• Additional Resources