Empirical Cloud Security, Second Edition

K. Sood Aditya

Description

The book discusses the security and privacy issues detected during penetration testing, security assessments, configuration reviews, malware analysis, and independent research of the cloud infrastructure and Software-as-a-Service (SaaS) applications. The book highlights hands-on technical approaches on how to detect the security issues based on the intelligence gathered from the real world case studies and also discusses the recommendations to fix the security issues effectively. This book is not about general theoretical discussion rather emphasis is laid on the cloud security concepts and how to assess and fix them practically.

Sujets

• Informatique
• Cloud computing
• Network security
• Computer security
• Informatique dans les nuages

Informations

• Publié par: De Gruyter
• Date de parution: 22 juin 2023
• Nombre de lectures: 0
• EAN13: 9781501517990
• Langue: English
• Poids de l'ouvrage: 13 Mo

Extrait

E MPIRICAL C LOUD S ECURITY

Second Edition

license, disclaimer of liability, and limited warranty

B pûçhàsî ô ûsî hîs bôôk (hé “Wôk”), ôû àéé hà hîs îçésé às péîssîô ô ûsé hé çôés çôàîé hééî, bû ôés ô îvé ôû hé îh ô ôwéshîp ô à ô hé éxûà çôé î hé bôôk ô ôwéshîp ô à ô hé îôàîô ô pôûçs çôàîé î î.Thîs îcense does not permît upoadîng of the Work onto the Internet or on a network (of any kînd) wîthout the wrîtten consent of the Pubîsher.Dûpîçàîô ô îsséîàîô ô à éx, çôé, sîûàîôs, îàés, éç. çôàîé hééî îs îîé ô à sûbjéç ô îçésî és ô hé éspéçîvé pôûçs, à péîssîô ûs bé ôbàîé ô hé Pûbîshé ô hé ôwé ô hé çôé, éç., î ôé ô épôûçé ô éwôk à pôîô ô hé éxûà àéîà (î à éîà) hà îs çôàîé î hé Wôk.

M ercury L earnIngand ï nformatIon (“MLï” ô “hé Pûbîshé”) à àôé îvôvé î hé çéàîô, wîî, pôûçîô, àççôpàî àôîhs, çôé, ô çôpûé pôàs (“hé sôwàé”), à à àççôpàî Wéb sîé ô sôwàé ô hé Wôk, çàô à ô ô wàà hé péôàçé ô ésûs hà îh bé ôbàîé b ûsî hé çôés ô hé Wôk. Thé àûhô, évéôpés, à hé Pûbîshé hàvé ûsé héî bés éôs ô ésûé hé àççûàç à ûçîôàî ô hé éxûà àéîà à/ ô pôàs çôàîé î hîs pàçkàé; wé, hôwévé, àké ô wàà ô à kî, éxpéss ô îpîé, éàî hé péôàçé ô hésé çôés ô pôàs. Thé Wôk îs sô “às îs” wîhôû wàà (éxçép ô ééçîvé àéîàs ûsé î àû- àçûî hé bôôk ô ûé ô àû wôkàshîp).

Thé àûhô, évéôpés, à hé pûbîshé ô à àççôpàî çôé, à àôé îvôvé î hé çôpôsîîô, pôûçîô, à àûàçûî ô hîs wôk wî ô bé îàbé ô ààés ô à kî àîsî ôû ô hé ûsé ô (ô hé îàbîî ô ûsé) hé àôîhs, sôûçé çôé, çôpûé pôàs, ô éxûà àéîà çôàîé î hîs pûbîçàîô. Thîs îçûés, bû îs ô îîé ô, ôss ô évéûé ô pôî, ô ôhé îçîéà, phsîçà, ô çôséqûéîà ààés àîsî ôû ô hé ûsé ô hîs Wôk.

Thé sôé éé î hé évé ô à çàî ô à kî îs éxpéss îîé ô épàçé- é ô hé bôôk à ô à hé îsçéîô ô hé Pûbîshé. Thé ûsé ô “îpîé wàà” à çéàî “éxçûsîôs” và ô sàé ô sàé, à îh ô àpp ô hé pûçhàsé ô hîs pôûç.

E MPIRICAL C LOUD S ECURITY

Practical Intelligence to Evaluate Risks and Attacks

Second Edition

A K. S DITYA OOD

M ERCURY L EARNINGAN I N D FORMATION Dulles, Virginia Boston, Massachusetts New Delhi

Côpîh ©2023 b Mercury LearnIng and ïnformatIon LLC. A îhs ésévé.

Thîs pubîcatîon, portîons of ît, or any accompanyîng software may not be reproduced în any way, stored în a retrîeva system of any type, or transmîtted by any means, medîa, eectronîc dîspay or mechanîca dîspay, încudîng, but not îmîted to, photocopy, recordîng, Internet postîngs, or scannîng, wîthout prîor permîssîon în wrîtîng from the pubîsher.

Pûbîshé: Dàvî Pààî Mercury LearnIng and ïnformatIon 22841 Qûîçksîvé Dîvé Dûés, VA 20166 îô@éçéàî.çô www.éçéàî.çô 800-232-0223

Aîà K. Sôô.Empîrîca Coud Securîty: Practîca Inteîgence to Evauate Rîsks and Attacks, 2/E. ïSBN: 978-1-50152-139-3

Thé pûbîshé éçôîzés à éspéçs à àks ûsé b çôpàîés, àûàçûés, à évéôpés às à éàs ô îsîûîsh héî pôûçs. A bà àés à pôûç àés éîôé î hîs bôôk àé àé- àks ô sévîçé àks ô héî éspéçîvé çôpàîés. A ôîssîô ô îsûsé (ô à kî) ô sévîçé àks ô àéàks, éç. îs ô à àép ô îîé ô hé pôpé ô ôhés.

Lîbà ô Côéss Côô Nûbé: 2023934889

232425321

Thîs bôôk îs pîé ô àçî-éé pàpé î hé Uîé Sàés ô Aéîçà.

Oû îés àé àvàîàbé ô àôpîô, îçésé, ô bûk pûçhàsé b îsîûîôs, çôpôàîôs, éç. Fô àîîôà îôàîô, péàsé çôàç hé Cûsôé Sévîçé Dép. à 800-232-0223(ô éé).

A ô ôû îés àé àvàîàbé î îîà ôà àacademîccourseware.comà ôhé îîà véôs. Thé sôé ôbîàîô ô Mercury LearnIng And ïnformatIon ô hé pûçhàsé îs ô épàçé hé bôôk, bàsé ô ééçîvé àéîàs ô àû wôkàshîp, bû ô bàsé ô hé ôpéàîô ô ûçîôàî ô hé pôûç.

I woud îke to dedîcate thîs book to my famîy, my wonderfu wîfe, Roshnî K Sood, and my son, Dîvye K Sood, for provîdîng contînuous support to compete thîs book. I am aso îndebted to my parents, my brother, my sîster, and my mentor.

C ONTENTS

Preface About the Author CHAPTER 1: CLOUD ARCHITECTURE AND SECURITY FUNDAMENTALS Uésàî Côû Vîûàîzàîô Côû Côpûî Môés Côpàî Vîûàîzàîô à Côû Côpûî Côàîéîzàîô î hé Côû

Components of Containerized Applications

Sévééss Côpûî î hé Côû

Components of Serverless Applications

Thé Chààçéîsîçs ô VMs, Côàîés, à Sévééss Côpûî

Côû Nàîvé Açhîéçûé, Appîçàîôs, à Mîçôsévîçés

Ebéî Séçûî îô Côû Nàîvé Appîçàîôs

Séçûî Côû Nàîvé Appîçàîôs

Côû Nàîvé Appîçàîô Pôéçîô Pàô (CNAPP)

Uésàî Zéô Tûs Açhîéçûé

Eé Côpûî Pààî Ebéî Séçûî î hé DévOps Môé Uésàî Côû Séçûî Pîàs Côû Séçûî Tésî à Asséssé Méhôôôîés Réééçés

xxi xxvii

1 2 3 5 6 7 8 9 10 11 12 13 15 17 19 20 21 24 28

viii C ONTENTS

CHAPTER 2: IAM FOR AUTHENTICATION AND AUTHORIZATION: SECURITY ASSESSMENT

Uésàî ïéî à Aççéss Mààéé Pôîçîés

IAM Policy Types and Elements

IAM Policy Variables and Identifiers

Managed and Inline Policy Characterization

IAM Users, Groups, and Roles

Trust Relationships and CrossAccount Access

IAM Access Policy Examples

IAM Access Permission Policy

IAM ResourceBased Policy

Role Trust Policy

ïéî à Résôûçé Pôîçîés: Séçûî Mîsçôiûàîôs

Confused Deputy Problems

OverPermissive Role Trust Policy

Guessable Identifiers in Role Trust Policy

Privilege Escalation via an Unrestricted IAM Resource

Insecure Policies for Serverless Functions

Unrestricted Access to Serverless Functions

Serverless Functions with Administrative Privileges

Serverless Function Untrusted CrossAccount Access

Unrestricted Access to the VPC Endpoints

Insecure Configuration in Passing IAM Roles to Services

Uploading Unencrypted Objects to Storage Buckets Without Ownership

Misconfigured Origin Access Identity for CDN Distribution

Aûhéîçàîô à Aûhôîzàîô Côôs Révîéw

Multi Factor Authentication (MFA)

User Credential Rotation

Password Policy Configuration

Administrative or Root Privileges

SSH Access Keys for Cloud Instances

29 31 31 33 35 36 38 39 39 40 41 43 43 45 47 49 50 51 51 53 54 55

57 61 63 63 64 65 66 67

C ONTENTS • ix

Unused Accounts, Credentials, and Resources 68 API Gateway ClientSide Certificates for Authenticity 69 Key Management Service (KMS) Customer Master Keys 70 Users Authentication from Approved IP Addresses and Locations 72 Réçôéàîôs 73 Aûôàîô Sçîps ô Séçûî Tésî 74 MFA Check (mfa_check.sh) 75 IAM Users Administrator Privileges Analysis (iam_users_admin_root_privileges. sh ) 76 IAM Users SSH Keys Analysis (iam_users_ssh_keys_check.sh) 77 Réééçés 78 CHAPTER 3: CLOUD INFRASTRUCTURE: NETWORK SECURITY ASSESSMENT 79 Néwôk Séçûî: Théàs à Fàws 81 Wh Péô à Néwôk Séçûî Asséssé? 82 Uésàî Séçûî Gôûps à Néwôk Aççéss Côô Lîss 82 Understanding VPC Peering 83 Séçûî Mîsçôiûàîôs î SGs à NACLs 85 Unrestricted Egress Traffic via SGs Outbound Rules 85 Unrestricted Egress Traffic via NACLs Outbound Rules 86 Insecure NACL Rule Ordering 87 OverPermissive Ingress Rules 89 Côû Néwôk ïàsûçûé: Pàçîçà Séçûî ïssûés 89 Insecure Configuration of Virtual Private Clouds 90 Public IP Assignment for Cloud Instances in Subnets 90 OverPermissive Routing Table Entries 91 Lateral Movement via VPC Peering 92 Insecure Bastion Hosts Implementation 93 Outbound Connectivity to the Internet 94 Missing Malware Protection and File Integrity Monitoring (FIM) 94 PasswordBased Authentication for the Bastion SSH Service 96