Not If but When: How Prepared Teams Defeat AWS Threats

This presentation is about understanding how attackers behave in AWS, building defenses that truly matter, and testing alerts and procedures so we are ready when something goes wrong. It shows what real-world breaches reveal about attacker patterns, how to strengthen defenses, and why preparation is the key to avoiding disasters. Because when an attacker breaches an account or a credential is leaked, it is not game over.

Transcript

1. Not If but When: How Prepared Teams Defeat AWS Threats
2. “If an attacker can inject code into the services you use, that's already game over.”
3. A Phishing Post on Bluesky, 8 September 2025. Available at: https://bsky.app/profile/bad-at-computer.bsky.social/post/3lydioq5swk2y Comment on Hacker News, 8 September 2025. Available at: https://news.ycombinator.com/item?id=45175125
4. A compromised NPM package Post on Wiz Blog, 16 September 2025. Available at: https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
5. A compromised browser or VSCode extension Post on Malwarebytes blog, 9 July 2025. Available at: https://www.malwarebytes.com/blog/news/2025/07/millions-of-people-spied-on-by-malicious-browser-extensions-in-chrome-and-edge Article on BleepingComputer, 13 September 2025. Available at: https://www.bleepingcomputer.com/news/security/whitecobra-floods-vscode-market-with-crypto-stealing-extensions/
6. Breaches happen. Disasters don’t have to.
7. Hi,I’m Adan! Security Engineer 15+ years of experience
8. Agenda How attackers really behave Building Defenses that Matter Proving We’re Ready 1 2 3
9. Act 1: How attackers really behave
10. An advanced technique…
11. Post on Invictus IR blog, 31 January 2024. Available at: https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me The reality
12. So are attackers really innovating that much…
13. 60+ AWS attack write-ups analyzed
14. In more than 80% of the analyzed attacks, persistence is achieved through the creation of IAM users.
15. EC2, IAM, SES and S3 are the prime battlegrounds Bedrock activity is increasing
16. Over a hundred potentially abusable events have been identified in research but remain unreported in the wild.
17. traildiscover.cloud
18. 90% of attacks in 90% of organizations are undifferentiated The Universal Cloud Threat Model The Universal Cloud Threat Model. Available at: https://securosis.com/wp-content/uploads/2024/04/UCTM_v_1.0.pdf
19. The Universal Cloud Threat Model. Page. 19. Available at: https://securosis.com/wp-content/uploads/2024/04/UCTM_v_1.0.pdf
20. The Universal Cloud Threat Model. Page. 20. Available at: https://securosis.com/wp-content/uploads/2024/04/UCTM_v_1.0.pdf
21. The Universal Cloud Threat Model. Page. 22. Available at: https://securosis.com/wp-content/uploads/2024/04/UCTM_v_1.0.pdf
22. The Universal Cloud Threat Model. Page. 23. Available at: https://securosis.com/wp-content/uploads/2024/04/UCTM_v_1.0.pdf
23. The Universal Cloud Threat Model. Page. 24. Available at: https://securosis.com/wp-content/uploads/2024/04/UCTM_v_1.0.pdf
24. Initial access isn’t game over Post on Medium, 9 February 2025. Available at: https://medium.com/@adan.alvarez/breached-not-game-over-learn-how-to-turn-the-tables-on-aws-attackers-1b8ec00fa83c
25. We don’t need perfect coverage to win Post on Medium, 5 September 2024. Available at: https://medium.com/@vanvleet/compound-probability-you-dont-need-100-coverage-to-win-a2e650da21a4
26. Act 2: Building Defenses that Matter
27. Turn on alerts for everything
28. A Big Dashboard of Problems Presentation at InfoQ, 12 September 2023. Available at: https://www.infoq.com/presentations/security-strategies/
29. From Dashboards to Defense
30. Least Privilege Presentation at AWS re:Inforce, 10 June 202. Available at: https://reinforce.awsevents.com/content/dam/reinforce/2024/slides/TDR432_New-tactics-and-techniques-for-proactive-threat-detection.pdf
31. Just-In-Time Access Presentation at fwd:cloudsec 2025 Europe, 16 September 2025. Available at: https://www.youtube.com/watch?v=2UZl85Y4nRo
32. Zero-Touch Production Presentation at fwd:cloudsec 2024 USA, 18 June 2024. Available at: https://www.youtube.com/watch?v=agzrIBY0ScQ
33. Progress Perfection - Reduce some permissions - Limit access for key roles - Automate tasks when possible
34. Focus on high-signal alerts We don’t need perfection. We just need enough chances to win
35. Act 3: Proving We’re Ready
36. Schrödinger’s Alerts: Are They Alive or Dead? Post on Medium, 2 September 2023. Available at: https://medium.com/@adan.alvarez/ensuring-alert-readiness-lessons-from-schr%C3%B6dingers-cat-bc14f862340d
37. When Practice is Missing
38. AWS SSO: The Session Trap
39. Demo Select a threat Simulate it Test the response https://www.canva.com/design/DAG2KTNmHIE/SVIP0NanAiG4a4ghGmGpdA/watch
40. How Prepared Teams Defeat AWS Threats Game Over Detection Opportunity Dashboards Guardrails Assumptions Validation
41. adan.cloud THANK YOU! It’s not game over. It’s our chance to respond and win.