CloudSec Wine

🔶 Vulnerable AWS Lambda function - Initial access in cloud attacks

How a vulnerable AWS Lambda function could be used by attackers, and some best practices to mitigate these attacks.

https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/

#aws

🔴 Geofencing a Globally Load Balanced service on GCP using Cloud Armor

How to use Cloud Armor to geofence a website/service running on GCP using Cloud Run, Google Cloud Storage (GCS) and the Global HTTP(S) Load Balancer.

https://medium.com/google-cloud/geofencing-a-globally-load-balanced-service-on-gcp-using-cloud-armor-44099480fd00

#gcp

🔶 Implementing a Vulnerable AWS DevOps Environment as a CloudGoat Scenario

A vulnerable "modern AWS DevOps environment" with an API, simulated user activity, and a continuous deployment pipeline.

https://blog.christophetd.fr/implementing-a-vulnerable-aws-devops-environment-as-a-cloudgoat-scenario/

#aws

🔶 Recover your AWS account via Customer Support

A Twitter thread on how to get AWS Customer Support to remove MFA from your root account.

https://twitter.com/jrhunt/status/1478935811336798211?s=12

#aws

🔷 Persistence with Azure Policy Guest Configuration

Use Azure Policy Guest Configuration to gain persistence in your target environment and how to detect such an attack as a defender.

https://cloudbrothers.info/en/azure-persistence-azure-policy-guest-configuration/

#azure

🔶 2 Critical Cloud Vulnerabilities to Convince You to Move to the Cloud

The Orca Security Research Team wrote about 2 critical zero-day vulnerabilities affecting AWS: Superglue and BreakingFormation. These vulnerabilities could've allowed unauthorized access to customer data and/or sensitive code and data within AWS.

https://orca.security/resources/blog/two-critical-cloud-vulnerabilities/

#aws

🔴 Impersonate the Cloud: Running your app locally as if you were on Google Cloud

Some ways to securely run an app locally with the exact same context as on Google Cloud.

https://www.iampulse.com/t/impersonate-the-cloud-running-your-app-locally-as-if-you-were-on-google-cloud

#gcp

🔷 Azure AD & IAM (Part II) ' Leveraging Managed Identities For Privilege Escalation

How to escalate privileges in Azure from low-privileged users to managed-identities.

https://orca.security/resources/blog/azure-ad-iam-part-ii-leveraging-managed-identities-for-privilege-escalation/

#azure

🔶 Get Email Notification On AWS IAM User Creation

Example CloudWatch rule and Lambda function to send an email via SES whenever an IAM user is created.

https://www.iampulse.com/t/get-email-notification-on-aws-iam-user-creation

#aws

🔴 Cloud-Native Ransomware Protection in GCP

The five pillars of the NIST CSF help create a layered security approach to the fight against ransomware.

https://scalesec.com/blog/cloud-native-ransomware-protection-gcp/

#gcp

🔷 NotLegit: Azure App Service vulnerability exposed hundreds of source code repositories

Another vulnerability discovered by the Wiz Research Team, where the Azure App Service exposed hundreds of source code repositories.

https://blog.wiz.io/azure-app-service-source-code-leak/

#azure

🙂 Dear friends,
Happy New Year 2022! 🎅

We wish you personal and career success. Stay with us. Next year we will continue to delight you with only high-quality content!

#HappyNewYear

🔶 Using CloudTrail to identify unexpected behaviors in individual workloads

A practical approach that you can use to detect anomalous behaviors within AWS workloads by using behavioral analysis techniques that can be used to augment existing threat detection solutions.

https://aws.amazon.com/ru/blogs/security/using-cloudtrail-to-identify-unexpected-behaviors-in-individual-workloads/

#aws

🔶 Using AWS security services to protect against, detect, and respond to the Log4j vulnerability

Post providing guidance to help customers who are responding to the recently disclosed log4j vulnerability.

https://aws.amazon.com/ru/blogs/security/using-aws-security-services-to-protect-against-detect-and-respond-to-the-log4j-vulnerability/

#aws

🔴 Continuous Compliance Engineering GCP case studies

Three real GCP controls framework technical examples for regulated FSI Google Cloud customers to help maintain security and compliance postures.

https://cloud.google.com/blog/products/compliance/continuous-compliance-engineering-gcp-case-studies

#gcp

🔶 Modernize your Penetration Testing Architecture on AWS Fargate

How you can use modern cloud technologies to build a scalable penetration testing platform, with no infrastructure to manage.

https://aws.amazon.com/ru/blogs/architecture/modernize-your-penetration-testing-architecture-on-aws-fargate/

#aws

🔴 Investigating the usage of GCP Service Accounts

Three GCP services to help you to investigate Google Cloud Service Account usage and mitigate against unintended consequences during key rotation.

https://cloud.google.com/blog/products/identity-security/three-services-to-investigate-gcp-service-account-usage

#gcp

🔶 Achieving Least Privilege with AWS IAM

Anthony Barbieri shares a few tips and tricks on the authorization side of IAM. Topics: client side monitoring and Cloudtrail, understanding which actions support resources restrictions, policy management, and leveraging conditions.

https://dev.to/prince_of_pasta/achieving-least-privilege-with-aws-iam-10i

#aws

🔶 Running AWS PCI DSS with CloudQuery Policies

CloudQuery policies gives you a powerful way to automate, customize, codify, and run your cloud security & compliance continuously with HCL and SQL. CloudQuery’s Yevgeny Pats describes their new AWS PCI DSS Policy, containing over 40 checks.

https://www.cloudquery.io/blog/running-aws-pci-dss-with-cloudquery-policies

#aws

🔶 Determining AWS IAM Policies According To Terraform And AWS CLI

The process of granting the least privileges required to execute "aws s3 ls" and "terraform apply" by a CI/CD runner.

https://www.iampulse.com/t/determining-aws-iam-policies-according-to-terraform-and-aws-cli

#aws