🔶🔷🔴 Cloud service provider security mistakes

Cloud historian Scott Piper has created a GitHub repo to catalogue security mistakes by cloud service providers (AWS, GCP, and Azure); that is, public mistakes on the cloud providers’ side of the shared responsibility model. Includes CVEs, SOC 2 Type 2 failures, security researchers compromising managed services, and more.

https://github.com/SummitRoute/csp_security_mistakes

#aws #azure #gcp

🔴 Over-Privileged Service Accounts Create Escalation of Privileges and Lateral Movement in Google Cloud

There are standard best practices for service accounts but many GCP environments lag behind in implementing these best practices. This research shown how these violations in best practices can allow attackers to chain together attack steps to gain broader access to resources in a GCP environment.

https://www.netskope.com/blog/over-privileged-service-accounts-create-escalation-of-privileges-and-lateral-movement-in-google-cloud

#gcp

🔶 AWS SageMaker Jupyter Notebook Instance Takeover

An attacker can run any code on a victim's SageMaker JupyterLab Notebook Instance across accounts. This means that an attacker can access the Notebook Instance metadata endpoint and steal the access token for the attached role.

https://blog.lightspin.io/aws-sagemaker-notebook-takeover-vulnerability

#aws

🔴 Using Google Cloud Service Account impersonation in your Terraform code

This blog details different ways to authenticate as a service account in Terraform code using short-lived credentials.

https://cloud.google.com/blog/topics/developers-practitioners/using-google-cloud-service-account-impersonation-your-terraform-code

#gcp

🔶 Snaring the Bad Folks

Blog post introducing Snare, Netflix's Detection, Enrichment, and Response platform for handling cloud security related findings. Snare is responsible for receiving millions of records a minute, analyzing, alerting, and responding to them.

https://netflixtechblog.com/snaring-the-bad-folks-66726a1f4c80

#aws

🔴 Best practices for using workload identity federation

This guide presents best practices for deciding when to use workload identity federation, and how to configure it in a way that helps you minimize risks.

https://cloud.google.com/iam/docs/best-practices-for-using-workload-identity-federation

#gcp

🔶🔷🔴 Cloud Security Remediation Guides

CloudSploit's remediation guides are intended to be an open-source resource for improving cloud security. Many cloud IaaS providers like AWS, Azure, and Google Cloud have a shared responsibility model. They provide the physical and architectural security, along with tools to properly secure the services they offer, but it is up to the user to configure those settings properly.

https://github.com/aquasecurity/cloud-security-remediation-guides

#aws #azure #gcp

🔶 Determining AWS IAM Policies According To Terraform And AWS CLI

The process of granting the least privileges required to execute "aws s3 ls" and "terraform apply" by a CI/CD runner.

https://www.iampulse.com/t/determining-aws-iam-policies-according-to-terraform-and-aws-cli

#aws

🔶 Running AWS PCI DSS with CloudQuery Policies

CloudQuery policies gives you a powerful way to automate, customize, codify, and run your cloud security & compliance continuously with HCL and SQL. CloudQuery’s Yevgeny Pats describes their new AWS PCI DSS Policy, containing over 40 checks.

https://www.cloudquery.io/blog/running-aws-pci-dss-with-cloudquery-policies

#aws

🔶 Achieving Least Privilege with AWS IAM

Anthony Barbieri shares a few tips and tricks on the authorization side of IAM. Topics: client side monitoring and Cloudtrail, understanding which actions support resources restrictions, policy management, and leveraging conditions.

https://dev.to/prince_of_pasta/achieving-least-privilege-with-aws-iam-10i

#aws

🔴 Investigating the usage of GCP Service Accounts

Three GCP services to help you to investigate Google Cloud Service Account usage and mitigate against unintended consequences during key rotation.

https://cloud.google.com/blog/products/identity-security/three-services-to-investigate-gcp-service-account-usage

#gcp

🔶 Modernize your Penetration Testing Architecture on AWS Fargate

How you can use modern cloud technologies to build a scalable penetration testing platform, with no infrastructure to manage.

https://aws.amazon.com/ru/blogs/architecture/modernize-your-penetration-testing-architecture-on-aws-fargate/

#aws

🔴 Continuous Compliance Engineering GCP case studies

Three real GCP controls framework technical examples for regulated FSI Google Cloud customers to help maintain security and compliance postures.

https://cloud.google.com/blog/products/compliance/continuous-compliance-engineering-gcp-case-studies

#gcp

🔶 Using AWS security services to protect against, detect, and respond to the Log4j vulnerability

Post providing guidance to help customers who are responding to the recently disclosed log4j vulnerability.

https://aws.amazon.com/ru/blogs/security/using-aws-security-services-to-protect-against-detect-and-respond-to-the-log4j-vulnerability/

#aws

🔶 Using CloudTrail to identify unexpected behaviors in individual workloads

A practical approach that you can use to detect anomalous behaviors within AWS workloads by using behavioral analysis techniques that can be used to augment existing threat detection solutions.

https://aws.amazon.com/ru/blogs/security/using-cloudtrail-to-identify-unexpected-behaviors-in-individual-workloads/

#aws

🙂 Dear friends,
Happy New Year 2022! 🎅

We wish you personal and career success. Stay with us. Next year we will continue to delight you with only high-quality content!

#HappyNewYear

🔷 NotLegit: Azure App Service vulnerability exposed hundreds of source code repositories

Another vulnerability discovered by the Wiz Research Team, where the Azure App Service exposed hundreds of source code repositories.

https://blog.wiz.io/azure-app-service-source-code-leak/

#azure

🔴 Cloud-Native Ransomware Protection in GCP

The five pillars of the NIST CSF help create a layered security approach to the fight against ransomware.

https://scalesec.com/blog/cloud-native-ransomware-protection-gcp/

#gcp

🔶 Get Email Notification On AWS IAM User Creation

Example CloudWatch rule and Lambda function to send an email via SES whenever an IAM user is created.

https://www.iampulse.com/t/get-email-notification-on-aws-iam-user-creation

#aws

🔷 Azure AD & IAM (Part II) ' Leveraging Managed Identities For Privilege Escalation

How to escalate privileges in Azure from low-privileged users to managed-identities.

https://orca.security/resources/blog/azure-ad-iam-part-ii-leveraging-managed-identities-for-privilege-escalation/

#azure

🔴 Impersonate the Cloud: Running your app locally as if you were on Google Cloud

Some ways to securely run an app locally with the exact same context as on Google Cloud.

https://www.iampulse.com/t/impersonate-the-cloud-running-your-app-locally-as-if-you-were-on-google-cloud

#gcp