AWS Understanding Common Cloud Security Threats to Cloud Services - cloud computing security - summary CH8

• Recognizing cloud service threats is essential for → proactive protection.

MITRE ATT&CK framework

• MITRE ATT&CK is a hacking techniques knowledge base.
• The cloud matrix of MITRE ATT&CK outlines → the general flow of cyber attacks.
• Includes stages like → initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, exfiltration, and impact.
• Understanding attack techniques → reveals potential attack outcomes.
• example :
• abusing credentials can provide attackers with persistent system access.
• cloud object storage discovery → enabling access to all objects in a cloud storage instance.
• Reviewing attack techniques → aids in identifying security controls for mitigation, whether using → built-in AWS tools or external third-party solutions.

Detecting and mitigating data breaches in cloud services

• A data breach involves unauthorized access to an organization's data, risking exposure of personal information and reputational damage.
• In cloud computing's shared responsibility model, physical data storage is beyond our control, posing a distinct threat compared to traditional on-premises management.
• Data breach likelihood increases in public cloud services where we lack control over physical data storage.
• The risk depends on the cloud service model and provider maturity.
• IaaS → customers are primarily responsible for implementing and managing security controls, including OS security, firewalls, and user access.
• PaaS → introduces a shared responsibility model, with the cloud provider handling OS-related tasks, while customers retain control over application-layer access.
• SaaS → no standard for SaaS, allowing those deploying applications on IaaS to declare themselves as SaaS providers.

• Depending on the maturity of the SaaS provider → we might enhance security controls
• data encryption at rest
• implement robust authentication (SAML with multi-factor authentication)
• access audit logs through REST APIs
• types of data stored in the cloud:
1. Public data: Information safe for public exposure, like news sites, currency rates, or an organization's address on a Contact Us page → if exposed by anonymous users, it will not hurt our organization
2. Intellectual property/trade secrets: Sensitive data critical for business success, such as research on a COVID-19 cure or technology for secure authentication without passwords → data that we must keep safe
3. Personally identifiable information (PII): Data containing identifiable details about individuals, including contact information, credit card details, healthcare data, etc.

Common consequences of data breaches

1. Breach of confidentiality: Involves exposing sensitive customer data for potential malicious use.
2. Data integrity: Entails unauthorized access to manipulate financial information, causing noticeable changes in account balances.
3. Availability: Results from ransomware attacks, encrypting data and making it temporarily or permanently inaccessible.

Best practices for detecting and mitigating data breaches in cloud environments

1. Networking layer: Set up access controls (ACLs, security groups) for resource access management.
2. Encryption: Apply encryption for continuous data confidentiality in transit and at rest.
3. Auditing: Keep records of resource access and actions, including API-related activities → keep track of who accessed (or tried to access).
4. Threat management: Analyze logs to identify potential service threats.
5. Recovery strategy: Develop a disaster recovery plan, including technical backups, volume snapshots, and automated recovery procedures using infrastructure as code.

Common AWS services to assist in the detection and mitigation of data breaches

1. Amazon VPC Controls: Use network ACLs, security groups, and AWS Network Firewall for network access rules.
2. AWS IAM: Configure authentication and access to applications, resources, and data through IAM.
3. AWS KMS: Encrypt data with AWS KMS to prevent data breaches.
4. AWS Secrets Manager: Keep access keys, passwords, and credentials secure from breaches using AWS Secrets Manager.
5. AWS Cloud Trail: Monitor API activities for potential data breaches.
6. Amazon Cloud Watch: Log and alert on suspicious activities exceeding set thresholds.
7. Amazon Guard Duty: Detect data breaches with Guard Duty.
8. AWS VPC Flow Logs: Review network activity for potential breaches.
9. AWS Config: Detect changes in environment and cloud resource configurations.
10. Amazon Detective: Identify the root cause of a data breach.
11. AWS Backup: Recover your environment after a data breach using AWS Backup.
12. AWS IAM Authentication: Configure access and authentication via AWS IAM; utilize IAM Access Analyzer for identifying unused accounts.
13. Amazon Guard Duty: Detect misconfigurations, like EC2 attempting access to command-and-control networks and publicly accessible S3 buckets.
14. AWS Config: Detect configuration changes against compliance policies and resources using AWS Config.
15. AWS Security Hub: Track events from various AWS services and identify misconfigurations against policy standards.
16. Amazon Inspector: Detect misconfigurations, such as deviations from CIS hardening benchmarks and missing security patches.
17. AWS Audit Manager: Identify misconfigurations against compliance standards.
18. AWS Trusted Advisor: Review common security misconfigurations.

Common AWS services to assist in the detection and mitigation of insufficient IAM and key management

1. AWS IAM Password Policies: Configure authentication, access, and enforce password policies with AWS IAM.
2. AWS IAM Access Analyzer: Detect inactive user accounts.
3. AWS Directory Service: Configure authentication, access, and enforce password policies for legacy servers and applications.
4. Multi-Factor Authentication (MFA): Enforce MFA for enhanced security.
5. AWS KMS: Generate, store, and rotate encryption keys.
6. AWS Secrets Manager: Generate, store, and rotate secrets, including credentials and access keys.
7. AWS Cloud Trail: Detect API activities, such as failed login attempts.

• AWS Key Management Service (KMS) encrypts and decrypts secrets, while AWS Secrets Manager securely manages and stores sensitive information for applications and services. KMS enhances security by encrypting secrets stored in Secrets Manager.

Detecting and mitigating account hijacking in cloud services

• Account Hijacking → Unauthorized access occurs when an account, be it human or system-related, is compromised. An unauthorized user gains access to resources and data using the compromised account's privileges.
• Account Hijacking Consequences:
1. Unauthorized access to resources.
2. Data exposure and leakage.
3. Data deletion.
4. System compromise.
5. Identity theft.
6. Ransomware or malicious code infection.
7. Account lock-out.
8. Denial of services.
9. Denial of wallet → potential high cloud spending due to resource misuse - like Bitcoin mining
10. Website defacement.

• Some common methods of account hijacking are as follows:
1. Phishing attacks targeting a system administrator's account, providing unauthorized access to databases containing customer data.
2. Access keys for a privileged account stored in a publicly accessible S3 bucket, enabling hackers to deploy costly virtual machines for bitcoin mining.
3. Weak administrator passwords leading to unauthorized access and permission changes, allowing public access to backups containing sensitive customer financial details.

Best practices for detecting and mitigating account hijacking

1. Enforce strong passwords through measures like minimum length, password age, history, complexity, account lockout, and more.
2. Mandate the use of Multi-Factor Authentication (MFA) for enhanced account security.
3. Implement the principle of least privilege, granting permissions only as necessary for resource access.
4. Adhere to the concept of segregation of duties to prevent a single user from having excessive privileges, reducing the risk of sensitive actions being compromised.

Common AWS services to assist in the detection and mitigation of account hijacking

1. Leverage AWS IAM to manage authentication, access, and enforce password policies for applications, resources, and data.
2. Utilize AWS IAM Access Analyzer to identify users with inactive accounts.
3. Employ AWS Directory Service to control authentication and access for legacy servers and applications using Kerberos, while enforcing password policies.
4. Implement Multi-Factor Authentication (MFA) to enhance security by preventing unauthorized access using compromised user credentials.

Detecting and mitigating insider threats in cloud services

• Insider threat → involves authorized employees, either intentionally or accidentally, performing actions that are unauthorized.
• common consequences of insider threats are as follows :
• loss of data, data leakage, system downtime, loss of company reputation, and monetary loss due to lawsuits.

Common AWS services to assist in the detection and mitigation of insider threats

1. Use Amazon Guard Duty for anomaly detection.
2. Implement AWS Cloud Trail to monitor unauthorized API activities.
3. Utilize AWS KMS for data encryption and key access control.
4. Securely store and manage secrets with AWS Secrets Manager.
5. Promptly replace compromised credentials, secrets, and encryption keys when an account compromise is detected.

Detecting and mitigating insecure APIs in cloud services

• Modern developments rely on Application Programming Interfaces (APIs) for communication between system components.
• APIs are primarily based on web services, utilizing either Simple Object Access Protocol (SOAP) or REST APIs.
• Some common consequences of insecure APIs are as follows:
• Data breaches, Data leakage, Damage to data integrity, Denial of service

• examples of attacks exploiting insecure APIs:
1. Malicious code injection into a backend database through an API with inadequate input validation.
2. SQL injection attack via an exposed API, leading to customer data exfiltration from a retail site.
3. API-based penetration of a cloud service due to lacking access control mechanisms.
4. Unauthorized execution of remote commands against an internal system using a discovered API key from an open-source repository.

Common AWS services to assist in the detection and mitigation of insecure APIs

1. Utilize Amazon API Gateway → for inbound access to APIs in your cloud environment.
2. Employ AWS WAF → to detect and protect against application-layer attacks.
3. Leverage AWS Shield → to detect and defend against Distributed Denial of Service (DDoS) attacks.
4. Use AWS IAM to authorize access to APIs.
5. Employ Amazon Cloud Watch → to identify spikes in API requests.
6. Utilize AWS Cloud Trail to → monitor and identify users conducting API activity through the API gateway.
7. Implement Amazon Guard Duty → to detect potential hacking activities involving your APIs.
8. Utilize AWS Secrets Manager → to generate, store, and regularly rotate API keys for enhanced security.

Detecting and mitigating the abuse of cloud services

• Abuse of cloud services involves leveraging the scale and multi-tenancy architecture for malicious activities.
• Consequences of such abuse include:
• Loss of service availability due to Distributed Denial of Service (DDoS) attacks.
• Monetary loss resulting from the exploitation of cloud resources for bitcoin mining without the customer's knowledge.

• Some common examples of the abuse of cloud services are as follows:
1. DDoS attacks with multiple cloud servers.
2. Bitcoin mining using expensive cloud servers.
3. Email spam and phishing via the cloud.
4. Brute force attacks on passwords in the cloud.

Common AWS services to assist in the detection and mitigation of the abuse of cloud services

1. Set up billing alerts with Amazon Cloud Watch.
2. Control authentication and access with AWS IAM.
3. Detect configuration changes using AWS Config.
4. Employ AWS WAF for application-layer attack protection.
5. Use AWS Shield to defend against DDoS attacks.
6. Monitor API activities with AWS Cloud Trail.
7. Detect anomalous behavior with Amazon Guard Duty.
8. Configure network access rules with Amazon VPC controls and AWS Network Firewall.
9. Automatically deploy security patches with AWS Systems Manager Patch Manager.