CloudSecNext Summit & Training 2024

Walk with Mandy as she takes you through her journey from her first days of joining Elastic and her continued commitment to creating and maintaining a secure environment through self-defending environments using AI.

Cloud Encryption is seen as a valuable component of a robust data security strategy. But what does cloud encryption actually offer in terms of security? Cloud Encryption has multiple different types including Cloud Service Provider Managed and Customer Managed. Depending on the type - the security offered can range from another robust layer of access control to a false sense of security.

In this talk, we’ll cover the following: - Types of encryption (such as CSP Managed, Customer Managed) - Default encryption for services in cloud. - How cloud encryption impacts data perimeters. - How cloud encryption translates into and impacts cloud identity and access management. - Best practices and considerations for how to implement cloud encryption and data security in cloud.

Kubernetes is spreading through the world faster than a viral dance challenge on social media. As the K8S ecosystem on the cloud gains more attention and spotlight, hackers actively seek ways to bounce between clusters and clouds, aiming for unauthorized access.

Join us to delve deep into the K8S security fundamentals on AWS (EKS) and their logging system. Explore K8S TTPs, K8S to AWS attack vectors and IAM role abuse. Gain a comprehensive understanding of conducting threat hunting on EKS, utilizing AWS and K8S logs to identify threat actors, particularly related to lateral movement and privilege escalation methods within the K8S environment.You’ll come away with practical knowledge about the relevant logs and how to use them to investigate potentials attacks on K8S and EKS. Moreover, you’ll become familiar with mitigation recommendations to prevent future cyber-attacks. 

In this workshop participants will learn about how GCP is structured and organized. They will learn how IAM works in GCP and how it is utilized to grant users access to various resources.

Participants have the option of following along or setting up their own GCP environment and recreating the techniques we are covering in the workshop in their own environment.

After this workshop, participants should be able to comfortably navigate the gcloud cli as well as the GCP console. They will also have experience analyzing log events in GCP and identifying relevant data

Prerequisites

1. Laptop Required
2. Access to a Google Account - preferably with Google Cloud Platform and gcloud CLI

   1. Google Cloud Platform - 90-day, $300 free trial to get you started.

      1. If you want to follow along in your own environment, it is recommended that you download about a week beforehand and setup.

   2. How to install the gcloud CLI

The process of obtaining a FedRAMP ATO in the AWS cloud, often begins with a separation of federal and commercial resources. This separation, or sometimes a move to a new AWS account, is a long and tedious process when starting from zero. We can simplify and automate this process using Terraform with AWS Control Tower via AFT.

In this talk we'll look at how Terraform, AFT, and Control tower can be used to create an AWS Native, FedRAMP moderate landing zone. We'll then use the AFT managed pipeline to satisfy a NIST 800-53 control, demonstrating Terraform's FedRAMP automation capabilities.

In this talk, we’ll provide details of our recently released open-source project. After a technical overview, you’ll see a hands-on live demonstration of the CA and an example mTLS use case. 

You’ll learn how you could use this solution for your own applications and systems, to provide a secure and cost-effective certificate authority infrastructure.

Documentation: serverlessca.com Blog post: https://medium.com/@paulschwarzenberger/open-source-cloud-certificate-authority-75609439dfe7

Every organization recognizes the substantial productivity enhancements provided by AI assistants. Microsoft 365 Copilot, GitHub Copilot, and similar tools are prime examples of the benefits derived from using a Retrieval-Augmented Generation (RAG) architecture in enterprise settings. However, these AI solutions are often developed and deployed rapidly by vendors and organizations, which can lead to significant vulnerabilities.

In this talk, we will explore the threat model associated with these Copilots, demonstrate their internal mechanics, and discuss real-world examples of vulnerabilities, attack scenarios, and mitigation strategies.

Join us for an illuminating session on leveraging Kusto, Microsoft's powerful query language, for effective threat hunting. Kusto, offers unparalleled capabilities for analyzing large volumes of data with lightning speed and precision.

In this session, we'll dive into the fundamentals of Kusto and explore how it can be used to detect and investigate security threats within your organization's data ecosystem. From crafting complex queries to interpreting query results, attendees will learn practical tips and best practices for harnessing the full potential of Kusto in threat hunting scenarios. Whether you're new to Kusto or seeking to deepen your expertise, this session promises valuable insights to empower you in the ongoing battle against cyber adversaries.

Writing Terraform is so fun, surely writing some functionality for the provider's that underpin Terraform must be easy, right?

Let's walk all the way through confirming some functionality that was missing from the AzureRM Provider, to poking around at the provider source code, to writing, testing, and opening a PR to add the functionality we need, and how you can do so too!

In today's high-scale and high-velocity complex operations, the process and culture are as important as the technology that supports it.

In this talk, end-user unicorn AppsFlyer will talk about their journey to building a platform-as-a-product to achieve the velocity, predictability, and self-serve using GitOps to the massive scale their system today requires. We'll look at considerations like building trust into the dev process, correct PR etiquette, codification of resources for agility and automation, and better safety guardrails baked in, all powered by open source and CNCF technology - K8s, flux, Streamzi and OPA. 

This talk will examine how a real-world high-scale end-user company does this built on an open source and cloud native stack.

Whether you are a long time cloud security practitioner or if you are just getting started, this workshop will give you the tools to get cloud security up and running and under control at your organization. 

With millions of downloads and a large community of users, Prowler is one of the most used tools when it comes to cloud security assessments, hardening, incident response and security posture monitoring.Prowler has some new features and important changes in v4.

This includes multi-cloud architecture, python detections and remediations, and a load of new checks for compliance. We will teach how to get the most from Prowler and adapt it to your requirements.

Prerequisites - Laptop with the following:

1. Python 3.11

2. pip for Python
3. Git
4. IDE Code editor like VSCode installed in the operating system.

5. Enough credentials for their own AWS, GCP or Azure infrastructure to create users and/or roles.

6. If willing to do the K8s labs, have permissions to create Kubernetes manage service in their cloud or Docker Desktop installed.

Driving your organization toward least privilege involves more than just monitoring administrative access. Access to business data can be as critical as administrative access to systems, particularly in highly regulated industries. With the rise of AI capabilities - discovery, ransomware, and data leakage and exfiltration are bigger threats than before.

In this talk, we'll cover how to define controls and their use cases, as well as how to identify common resources utilized by the business. We'll highlight the parallels between managing administrative systems and business data and provide frameworks for governing privileged user access like privileged admin access. You'll leave with a practical list of go-do's and quick wins to embark on the next phase of your journey toward least privilege.

It's funny how some of the most common patterns in engineering organizations are essentially anti-patterns when it comes to access control and safety. 

In this talk, we'll take you down the rabbit hole of bad access control practices we've witnessed firsthand at clients and partners, that you should definitely rethink. This includes everything from shared admin accounts, shared passwords, over-privileged and long-lasting highly privileged accounts.We'll show how these bad practices can ultimately result in significant harm to your organization––everything from the obvious hijacking of accounts, through social engineering tactics and techniques these practices open the doors wide open to, and how with access to sensitive IT systems, you can put your company and client data at serious risk. We'll walk through real live scenarios of adversarial attacks using the most common methods that are still prevalent in the wild––along with a real world HUMINT (AKA social engineering) and PsyOps that are the backbone to psycho-cyber kill chains. We'll provide practical tips for how to prevent these types of attacks both on a human level and technical level. You'll come away with better security hygiene for your organization, and vigilance as the gatekeeper and guardians.

AWS, Azure, and GCP all offer a managed Kubernetes service. In addition, all three also offer integration with their IAM backbone to allow both authentication into the cluster from a cloud identity, and providing of IAM credentials to workloads on the cluster to allow secure access to the cloud provider APIs. While this is a valuable feature for securing managed Kubernetes clusters without adding additional identity mechanisms, it's yet another feature for Cloud Security teams to understand and secure.

This talk will explore the identity integrations between each of the Cloud Providers and their managed Kubernetes flavors, at a code level to dispel any ambiguity on where the Cloud Provider APIs work with the managed clusters to provide authentication. We will explore how access is granted to cloud identities, and what boundaries can be crossed (eg - cross account access, etc), as well as potential abuse cases. For the defender, we will also specifically talk about how these identities tie into cluster logging, and to trace the full range of events even when someone is authenticating into a cluster using their cloud credentials

The Microsoft Azure threat matrix contains a mysterious and almost empty item: AZT508 - Azure Policy, which suggests this service can break bad but gives almost no details as to how. To quote Microsoft: “Azure Policy helps to enforce organizational standards and to assess compliance at-scale.“ How does this banal sounding service come to be used for attacking Azure users?

This talk aims to fill in the picture. We will explore the Azure Policy service and how it can be used for badness: punching holes in ACLs, creating persistent backdoors on virtual machines, assigning attacker controlled roles to resources, modifying database encryption, etc. I will demo an abuse scenario, and discuss others that can be used for privilege escalation and persistence. I will also discuss a confused deputy attack on this service. Finally, I will share detection and control recommendations.

The rapid advancements in Generative AI have opened up a new frontier in cybersecurity, presenting both unprecedented opportunities and daunting challenges. This presentation aims to equip attendees with the critical knowledge and tools needed to navigate the evolving threat landscape shaped by the rise of AI-powered cyber attacks.

The session will delve into the dark side of Generative AI, showcasing how malicious actors are weaponizing this technology to create highly sophisticated phishing campaigns, develop advanced malware, and introduce novel attack methods such as LLM supply chain poisoning. Through real-world examples, participants will gain a comprehensive understanding of the emerging risks associated with Generative AI in the context of cybersecurity. However, the presentation will also emphasize the importance of harnessing the potential of Generative AI responsibly to strengthen organizational defenses.

Attendees will learn essential security strategies and best practices to fortify their systems against AI-driven threats, as well as techniques to identify and neutralize these evolving attacks proactively. By striking a balance between exploring the dark side of Generative AI and empowering participants to adapt their defenses accordingly, this session aims to foster a more secure and resilient cybersecurity landscape in the face of this transformative technology.

Containers can be a powerful DevOps tool to greatly improve the consistency and scalability of your environment. But how do we establish visibility and security in our containers without excessive overhead?

We’ll start with an overview of the security challenges posed by containers, and how those can be magnified if we aren’t doing DevOps right. Next, we’ll go over DevSecOps best practices for harnessing the power of containers - starting with the image itself. We’ll look at how “shifting security left” applies specifically to containers, from the container pipeline itself, to secrets management and protecting your container registry itself. Lastly, we’ll conclude with a simple framework that will help your teams assess your DevSecOps maturity in relation to containers and identify action steps going forward.

Organizations can use defense in depth to enhance their security configuration management capabilities. Adopting defense in depth in this domain produces a mature, multi-layered strategy in which the organization establishes configuration baselines, defines those baselines in code, implements gating during code deployment processes, and monitors the environment for ongoing compliance.

In this discussion, we begin by describing the general approach to security configuration management within Cisco. We then dive into the details, exploring Open Policy Agent (OPA) as a tool for gating with policy as code during the Terraform build process.

This presentation includes a workshop that shows attendees how to write an OPA policy and use it within GitHub Actions.

Prerequisites

1. Github account
2. Git installed locally
3. IDE Code editor like VSCode installed in the operating system.

4. Docker or Podman (optional)

Threat Detection is hard- it requires deep knowledge about the platform you're detecting on, knowledge of how that platform is attacked, and the technical savvy to interpret logs and write code that detects on those attacks. So what do we do in the case of cloud platforms, where the platform and the logs are constantly changing?

This presentation will cover lessons learned in cloud threat detection, and present ways to build resiliency into the threat detection engineer's code and mindset.

How well are your security controls working in your cloud environment? Would you know if they had gaps an attacker could exploit? Could you prove it? Cloud service providers ship new features at breakneck speed. Currently, AWS has over 15,000 APIs and 16,000 permissions. At this scale, it can be difficult to define proper security controls for your organization, verify they’re working as intended, and catch regressions or gaps over time.

This presentation will discuss different implementations to validate preventive and detective controls in cloud environments. This talk focuses on AWS to provide concrete examples, but the concepts extend to any cloud environment. It will define provable security and explain how to achieve it with a framework that continuously assesses security controls to ensure functionality and find holes. We’ll walk through real-world examples of security controls with unexpected edge cases that cause failure conditions in the control, which can be proactively caught through automation. This presentation will provide examples and tangible guidance on how to automatically verify cloud security controls at scale and identify security gaps before attackers do.

Takeaways: Validating security controls is especially important in cloud environments due to the amount of different permissions and service configurations and how quickly they evolve. Doing this manually is not scalable or sustainable and automation must be leveraged. Attendees will learn how to build automation to validate their controls and how to look for edge cases in common security controls. They’ll learn successful strategies, patterns to avoid, and how to handle testing complicated controls - all of which come from real experience in building and managing these systems. Attendees will learn how to validate their cloud security posture against techniques seen by threat actors targeting cloud environments.

Detecting threats in the cloud is a huge challenge. All cloud platforms offer audit logs of their cloud control planes (e.g., AWS CloudTrail, Google Cloud Platform Audit Logs, Azure Activity Logs) but these generate such a high volume of logs that wading through them to find indications of a threat can be overwhelming.

In this talk, I’ll explain how you can create your own detection platform and build custom analytics to search for whatever needle you want to find in the haystack of logs by taking this massive stream of data and breaking it down into manageable chunks using basic cloud building blocks like S3 buckets and SQS queues, or more sophisticated tools like OpenSearch and Kubernetes.

It appears that every few months, there's news of yet another cloud breach stemming from a carelessly configured cloud storage solution. While this isn't the default for most cloud vendors, some users still manage to make their cloud data publicly accessible by going out of their way - sometimes to a significant extent. Whether it's out of ignorance or convenience, it doesn't matter - this practice must come to an end.

To address this issue, we've developed a workshop that equips attendees with various techniques and methods to identify and rectify cloud storage misconfigurations in their own cloud accounts. We'll even demonstrate some ways to prevent these misconfigurations from happening in the first place. Although the chosen vendor for this workshop is AWS, due to its Simple Storage Service (S3) being the one making headlines, misconfigurations could occur in any cloud environment. Hence, the techniques discussed in this workshop will be applicable to all cloud vendor environments, including Azure, Google Cloud Platform, and Oracle.

LEARNING OBJECTIVES:

• Discover all-too-common cloud storage security deficiencies present as either insecure vendor defaults or careless mistakes

• Correct these issues using a variety of means (e.g., cloud management console, command line tools, and Infrastructure-as-Code)

PREREQUISITE KNOWLEDGE:
None.

SYSTEM REQUIREMENTS:

• Laptop with a modern web browser

• AWS account with root access or an IAM user with Administrator Access permissions

  • If you need an AWS account, you can create a free tier account with root access at https://aws.amazon.com/free/. The cost will be minimal (pennies) to complete the workshop

This workshop supports both SEC388: Introduction to Cloud Computing and Security and SEC488: Cloud Security Essentials.

In today's rapidly evolving cloud landscape, managing identities effectively is paramount to maintaining a secure and compliant environment. However, as organizations embrace multi-cloud strategies and adopt diverse cloud-native technologies, they often face an "identity crisis" characterized by complex access management, fragmented user identities, and inconsistent authentication mechanisms.

This presentation delves into the heart of cloud identity challenges, offering insights gleaned from real-world implementations and hard-won lessons. Drawing from experiences across various industries, we'll explore the common pitfalls and stumbling blocks encountered when navigating cloud identity, including: Fragmented Identity Landscapes: Understanding the complexities of managing identities across multiple cloud providers, SaaS applications, and on-premises systems. Authentication Dilemmas: Balancing usability and security in authentication methods, including single sign-on (SSO), multi-factor authentication (MFA), and biometric authentication. Authorization Conundrums: Tackling the nuances of fine-grained access control and permissions management in cloud environments, including role-based access control (RBAC) and attribute-based access control (ABAC). Identity Federation Challenges: Overcoming interoperability hurdles and establishing trust between identity providers in federated identity scenarios. Having navigated through these challenges firsthand, we'll share practical strategies and best practices for implementing robust identity solutions in the cloud. From establishing a cohesive identity governance framework to leveraging identity as a security perimeter, attendees will gain actionable insights to strengthen their organization's identity posture and mitigate security risks.

Key Takeaways: Gain a deeper understanding of the unique identity challenges inherent in cloud environments. Learn from real-world case studies and best practices for overcoming cloud identity obstacles. Discover strategies for implementing robust and scalable identity solutions across multi-cloud architectures. Acquire actionable insights to enhance identity governance and strengthen security posture in the cloud.

Cyber deception enables defenders to impose costs on threat actors, better understand adversary TTPs, and provide high-fidelity detection. Yet, most enterprises don’t deploy deception environments due to the complexity and upfront costs of designing and deploying realistic, high-interaction honeypots. Drawing from real-world experience as a Security Engineer specializing in Threat Intelligence at Google, Jonathan will discuss how to catch hackers in the act with deception as well as how GenAI can be used to lower the barrier of entry for creating realistic cloud deception environments.

This talk will cover lessons learned at Google Cloud and help make deception more approachable for enterprises of all sizes. Cybersecurity professionals will learn why deception environments are valuable, how to design a realistic environment, and common pitfalls to avoid.