SEC510: Public Cloud Security: AWS, Azure, and GCP

Overview

SEC510 starts with a brief overview of the public cloud adoption trends. We will examine the factors driving the rise in popularity of Azure and GCP, which historically have lagged far behind AWS. Students will then initialize their lab environment and deploy a modern web application to each of the Big 3 providers.

This leads into an analysis of one of the most fundamental and misunderstood concepts in cloud security: Identity and Access Management (IAM). Students will compromise real IAM credentials from cloud virtual machines using the Instance Metadata Service (IMDS) to examine firsthand how an attacker can use them to access sensitive cloud data.

The remainder of this section will focus on how to harden the IMDS and leverage well-written IAM policies to minimize the harm caused by such attacks. These strategies are critical to prevent a minor vulnerability from becoming front-page news.

Exercises

• VM Credential Exposure
• Hardening AWS IAM Policies
• Hardening Azure and GCP Policies
• Advanced IAM Features
• Bonus Challenges (Section 1)

Topics

The Multicloud Movement

• Cloud Market Trends
• Multicloud Considerations
• Cloud Procurement through Mergers and Acquisitions
• Shadow Cloud Accounts

Multicloud Security Assessment

• Cyber Defense Matrix
• Center for Internet Security (CIS) Cloud Foundations Benchmarks
• MITRE ATT&CK Cloud Matrix
• Lab Environment Introduction
• HashiCorp Terraform Overview

Identity and Access Management

• Identities
• Policies
• Organization-Wide Controls
• AWS IAM
• Azure Active Directory (Azure AD) and Microsoft Entra ID
• Google Cloud IAM

Cloud Metadata and Credential Services

• The Cloud Instance Metadata Service (IMDS) for each cloud provider
• IMDS Compromise Case Study
• IMDS Hardening

Related Application Vulnerabilities

• Command Injection

SERVER-SIDE REQUEST FORGERY

Overview

Section 2 covers how to lock down infrastructure within a virtual private network. As the public cloud IP address blocks are well known and default network security is often lax, millions of sensitive assets are unnecessarily accessible to the public Internet. This section will ensure that none of these assets belong to your organization.

It begins by demonstrating how ingress and egress traffic can be restricted within each provider. Students will analyze the damage that can be done without these controls by accessing a public-facing database and creating a reverse shell session in each environment. We will then eliminate both attack vectors with secure cloud configuration.

The next module covers cloud-based network analysis capabilities to address malicious traffic on network channels that cannot be blocked. Students will analyze cloud flow logs and search for indicators of compromise. The module also covers AWS Traffic Mirroring and Google Cloud Packet Mirroring, both of which have associated Bonus Challenges.

With our infrastructure locked down, we pivot to controlling network access to Platform as a Service (PaaS) using Private Endpoints. We will demonstrate how defenders can use these endpoints to restrict data access to internal networks and how attackers can abuse them to exfiltrate data.

This section concludes with techniques for securely granting organization members access to assets in private cloud networks. These techniques allow an organization to work effectively while keeping internal systems off the public internet.

Exercises

• Network Lockdown
• Analyzing Network Traffic
• Private Endpoint Security
• Cloud VPN and Managed SSH
• Bonus Challenges (Section 2)

Topics

Cloud Virtual Networks

• Network Service Scanning
• Default Network Configuration
• Network Security Groups

Network Traffic Analysis

• Flow Logging
• AWS Traffic Mirroring
• Google Cloud Packet Mirroring
• Google Cloud Firewall Rules Logging

Private Endpoints

• AWS PrivateLink
• Azure Private Link
• Google Cloud Private Google Access
• Google Cloud VPC Service Controls
• Custom Service Endpoints

Advanced Remote Access

• Managed SSH
• Hybrid VPN Gateways
• AWS Session Manager
• Azure Bastion
• Google Cloud OS Login
• Google Cloud Identity-Aware Proxy (IAP)

Command and Control ServersSoftware Supply-Chain Attacks

Overview

Data security is as important, if not more important, in the cloud than it is on-premises. There are countless cloud data leaks that could have been prevented with the appropriate controls. This section examines the cloud services that enable data encryption, secure storage, access control, data loss detection, policy enforcement, and more.

The first half of Section 3 covers all you need to know about encryption in the cloud. Students will learn about each provider's cryptographic key management solution and how it can be used to apply multiple layers of encryption at rest. Students will also learn how in-transit encryption is performed throughout the cloud, such as the encryption between clients, load balancers, applications, and database servers. These techniques will improve your organization's security while satisfying its legal and compliance needs.

The second half of Section 3 is primarily focused on cloud storage services. After briefly discussing the most basic storage security technique, turning off public access, it will cover more advanced controls like organization-wide access control, file versioning, data retention, secure transit, and more. It concludes with a discussion of additional data exfiltration paths and how to automatically detect sensitive data storage.

Exercises

• Audit Decryption Events
• Encrypt All The Things!
• Storage Service Lockdown
• Sensitive Data Detection and Exfiltration
• Bonus Challenges (Section 3)

Topics

Cryptographic Key Management

• AWS KMS
• Azure Key Vault
• Google Cloud KMS
• Overview of Single-Tenant Alternatives: AWS CloudHSM, Azure Dedicated HSM, and Azure Key Vault Managed HSM
• Key Usage Audit Logging

Encryption with Cloud Services

• Disk-Level Encryption
• Service-Level Encryption
• Column-Level Encryption
• In-Transit Encryption

Cloud Storage Platforms

• Access Control
• Audit Logs
• Data Retention

Sensitive Data Detection and Exfiltration

• Data Exfiltration Paths
• Signed URLs
• Amazon Macie
• Amazon CloudWatch Logs Data Protection
• Overview of Microsoft Purview and Azure Information Protection
• Google Cloud Data Loss Prevention

Overview

This section teaches students how to secure the infrastructure powering their cloud-based applications and how to protect the users of those applications. It begins with App Services, platforms that simplify the process of running and scaling cloud applications. This leads into a computing paradigm taking the industry by storm: serverless Functions as a-Service (FaaS). It balances the discussion of the challenges serverless introduces with the advantages it provides in securing product development and security operations. After introspecting the serverless runtime environments using Serverless Prey (an open-source tool written by the course authors), students will examine and harden practical serverless functions in a real environment. They will also learn how FaaS security impacts App Service security.

The next module covers how Customer Identity and Access Management (CIAM) can help track and authenticate the users of an organization's applications. The Google Cloud Platform obtained their CIAM services through their acquisition of a company named Firebase. The section concludes with a detailed breakdown of this CIAM and its interplay with Firebase's flagship product, the Realtime Database. This highly popular but rarely reviewed service is a serverless database with many access control considerations and security implications for Google Cloud projects.

Exercises

• App Service Security
• Serverless Prey
• Hardening Serverless Functions
• Login with the Microsoft Identity Platform
• Broken Firebase Database Access Control
• Bonus Challenges (Section 4)

Topics

App Services

• Overview of AWS Elastic Beanstalk
• Azure App Service
• Google App Engine

Cloud Serverless Functions

• Security Advantages and Concerns
• Function as a Service Defense
• Persistence with Serverless

Cloud Customer Identity and Access Management (CIAM)

• Overview of OAuth 2.0, OpenID Connect (OIDC), and SAML
• Amazon Cognito User Pools
• Microsoft Identity Platform
• Overview of Azure AD Business-to-Consumer (B2C) and Microsoft Entra External ID for Customers
• Google Cloud Identity for Customers and Partners (CICP)
• Firebase Authentication

Firebase Databases and Google Cloud Implications

• Realtime Database
• Cloud Firestore
• Google Cloud Privilege Escalation via Firebase
• Compliance Concerns

Overview

The course concludes with practical guidance on how to operate an organization across multiple cloud providers. Many of the topics discussed in the sections become more complicated if an organization's cloud providers are integrated with one another. We begin by discussing how multicloud integration impacts Identity and Access Management (IAM). Many organizations use long-lived credentials to support multicloud integrations. These credentials are much more valuable to attackers than those that are short-lived. Although students will learn best practices for long-lived credentials, this will only mitigate the risk, not eliminate it. This module goes one step further by demonstrating novel ways to use Workload Identity Federation to authenticate from one cloud provider to another with short-lived cloud credentials.

The next module covers the cloud-native Cloud Security Posture Management (CSPM) services. Students will use these services to automate security checks for the Center for Internet Security (CIS) Benchmarks we have covered throughout the course. With these capabilities, an organization can take the lessons learned in SEC510 and apply them at scale.

The final module, Multicloud CSPM, ties these two topics together. Most organizations would prefer to use a single platform to assess the security posture of all of their clouds. After learning about the third-party multicloud CSPM services, students will leverage Workload Identity and Microsoft Defender for Cloud to analyze the security posture of all three cloud providers. If implemented properly, this capability will be invaluable to security organizations. If done wrong, this integration can decrease the security of the organization's AWS accounts and Google Cloud projects. This module will highlight these pitfalls to ensure that students engineer this correctly from the start.

Exercises

• Secure Multicloud Integration
• Automated Benchmarking
• Microsoft Defender and Multicloud
• Bonus Challenge Finale
• Lab Teardown
• Bonus Challenges (Section 5)

Topics

Multicloud Access Management

• Risks from Long-Lived Credentials
• Workload Identity Federation
• Cross-Cloud Authentication Without Long-Lived Credentials

Cloud Security Posture Management

• AWS Security Hub
• Azure Security Center
• Google Cloud Security Command Center
• Open-Source Solutions

Multicloud Security Posture Management

• Third-Party Multicloud Security Posture Management
• Microsoft Defender for Cloud CSPM

Summary

Additional Resources