Upgrade to Pro — share decks privately, control downloads, hide ads and more …

How to 10X Your Cloud Security (Without the Ser...

Rami McCarthy
September 11, 2024
1.7k

How to 10X Your Cloud Security (Without the SeriesΒ D)

I’ll summarize and distill the actionable guidance for scaling Cloud Security programs from the vast array of talks and blog posts our there. We'll blaze through a dense view of what cloud security is, how you can do it more effectively, and what the near future looks like. After the talk, you'll have practical takeaways, and a lengthy, curated bibliography to lean on.

Rami McCarthy

September 11, 2024
Tweet

Transcript

  1. πŸ‡ΈπŸ‡ͺ I just moved from Boston to Stockholm πŸ‡ΊπŸ‡Έ @ramimacisabird

    πŸ”— ramimac.me Definitely not just to buff my fwd:cloudsec CFP…
  2. @ramimacisabird πŸ”— ramimac.me Philosophy 1. Do things that don’t scale,

    automate as much as possible to scale Phil Venables - Delivering Security at Scale: From Artisanal to Industrial
  3. @ramimacisabird πŸ”— ramimac.me Philosophy 1. Do things that don’t scale,

    automate as much as possible to scale 2.High-signal, low-noise tools and alerting
  4. @ramimacisabird πŸ”— ramimac.me Philosophy 1. Do things that don’t scale,

    automate as much as possible to scale 2.High-signal, low-noise tools and alerting β€’ Simplicity & Signal > Capabilities β€’ Distributed alerting and responsibility for security tasks
  5. @ramimacisabird πŸ”— ramimac.me Philosophy 1. Do things that don’t scale,

    automate as much as possible to scale 2.High-signal, low-noise tools and alerting 3.Guardrails, not gatekeepers
  6. @ramimacisabird πŸ”— ramimac.me Philosophy 1. Do things that don’t scale,

    automate as much as possible to scale 2.High-signal, low-noise tools and alerting 3.Guardrails, not gatekeepers 4.Security as partnership. Embed security in development process
  7. @ramimacisabird πŸ”— ramimac.me Security-as-Partnership Jacob Salassi - Why shifting left

    doesn't work & asks too much from everyone β€’ Security Champions are human crutches that prop up cumbersome processes that don’t scale β€’ Every security consultation is a failure
  8. @ramimacisabird πŸ”— ramimac.me Philosophy 1. Do things that don’t scale,

    automate as much as possible to scale 2.High-signal, low-noise tools and alerting 3.Guardrails, not gatekeepers 4.Security as partnership. Embed security in development process 5.Tools devs can build, others can operate
  9. @ramimacisabird πŸ”— ramimac.me Philosophy 1. Do things that don’t scale,

    automate as much as possible to scale 2.High-signal, low-noise tools and alerting 3.Guardrails, not gatekeepers 4.Security as partnership. Embed security in development process 5.Tools devs can build, others can operate 6.The limits of desirable security Karsten Nohl - When Enough Is Enough: The Limits Of Desirable Security
  10. @ramimacisabird Security Program Invariants Vulnerability & Asset Management Identity &

    Access Management Detection ( Deployment Eight Seven Six sections Thirty-odd minutes
  11. @ramimacisabird πŸ”— ramimac.me Security Program: All About Attack Surface 1.Account

    Architecture 2.Service & Action Allowlists 3.Zero Trust & Zero Touch 4.Identify a baseline, meet it, enforce with invariants, raise it The Path to Zero Touch Production Kane Narraway - How We Built Zero Trust
  12. @ramimacisabird πŸ”— ramimac.me Security Program: Metrics Alex Smolen - Building

    Effective Security OKRs β€’ Example metrics: β€’ Time to detection of vulnerabilities β€’ Time to remediation of vulnerabilities β€’ Average vulnerabilities over time β€’ Good vulnerability metadata allows for good vulnerability metrics
  13. @ramimacisabird πŸ”— ramimac.me Security Program: Metrics Collin Green - Product

    security primitives β€’ % of β€œreally bad” bugs vs total security bugs β€’ Classes of bugs going down with investment to prevent them Ryan McGeehan - A key performance indicator for infosec organizations, Killing β€œChicken Little” : Measure and eliminate risk through forecasting β€’ Probabilistic, risk-based KPIs with expert estimation
  14. @ramimacisabird πŸ”— ramimac.me Security Program: Proactive Efficiency β€œwhy not ask

    ourselves how the team would cope if the workload went up another 30%, but bad financial results precluded any team growth? It's actually fun to think about such hypotheticals ahead of the time - and hey, if the ideas sound good, why not try them out today?β€œ lcamtuf - Getting Product Security Engineering Right
  15. @ramimacisabird πŸ”— ramimac.me Security Program: Simple Evangelism 1. β€œHere’s how

    we’ll get hacked” 2. β€œHere’s why security matters"
  16. @ramimacisabird πŸ”— ramimac.me Invariants Alex Smolen - What are Security

    Invariants? β€’ Identify Scope -> Measure Adherence -> Document Exceptions -> Prevent Regressions Chris Farris - Defining Security Invariants β€’ Preventing security risk comes at the expense of increasing operational risk
  17. @ramimacisabird πŸ”— ramimac.me Invariants Service Allow Listing Reducing Attack Surface

    with AWS Allowlisting Kinnaird McQuade - Security Guardrails at Scale in Azure
  18. @ramimacisabird πŸ”— ramimac.me VAM : Asset Inventory Current AND historic

    resource metadata Jake Berkowsky - Security Analytics with Wiz and Snowflake
  19. @ramimacisabird πŸ”— ramimac.me VAM : Managing Vulnerabilities Cheatsheets β€’Trend Micro

    - CloudConformity Knowledge Base β€’Datadog - Cloud Security Atlas
  20. @ramimacisabird πŸ”— ramimac.me VAM : Managing Vulnerabilities Jamie Finnigan -

    Severity ratings should mean something β€’Confidence ratings are an important modifier on vulnerability severity
  21. @ramimacisabird πŸ”— ramimac.me VAM : Getting Bugs Fixed Collin Greene

    - Fixing security bugs β€’Is prioritization correct? Is the bug clear? β€’Explain why security matters β€’Empathize, avoid Nagging β€’Escalating to a manager β€’β€œI want to make sure you are aware of this and I would like it to be fixed” not β€œengineer $foo has dropped this task n times” β€’β€œyou are in the small minority of people who have not fixed your open security bug” β€’Visualization, leaderboards, gamification
  22. @ramimacisabird πŸ”— ramimac.me Identity and Access: Scaling IAM Will Bengtson,

    Devon Powley - Bumps in the Road While Scaling Cloud Access β€’Direct federation β€’Zero access by default β€’Auto-approval Peter Collins, Elisa Guerrant - Heard you liked access, so we built Access to manage your access for Access JIT Cloud Access
  23. @ramimacisabird πŸ”— ramimac.me Desirable Least Privilege for Humans 1. Service

    level least privileging (carveouts for β€œcrown jewels”) 2. Chris Farris - Sensitive IAM Actions β€’ CredentialExposure β€’ DataAccess β€’ PrivEsc β€’ ResourceExposure
  24. @ramimacisabird πŸ”— ramimac.me Identity and Access: Service Identity 1. Cleanup

    unused access: Steampipe + Access Advisor 2.Make sure you’re on IMDSv2 : rami.wiki/imdsv2
  25. @ramimacisabird πŸ”— ramimac.me β€’ Allyn Stott - How I Learned

    to Stop Worrying and Build a Modern Detection & Response Program β€’ & The Fault in Our Metrics: Rethinking How We Measure Detection & Response Detection (Eng)
  26. @ramimacisabird πŸ”— ramimac.me Detection (Eng) Ryan McGeehan - Lessons Learned

    in Detection Engineering β€’ Great teams ‒… are aware of where, and how, analysis work is being created. ‒… don’t pass bad alerts from one on-call to the next. ‒… don’t pretend that every alert is worth being paged.
  27. @ramimacisabird πŸ”— ramimac.me Detection (Eng): Distributed Alerting β€’ SOC Automation

    Capability Matrix β€’Alert handling β€’Issue tracking β€’Enrichment β€’User Interaction β€’Response β€’Continuity β€’Procedural β€’Matt Knight - AI Cyber Challenge DefCon talk β€’singe/tidcli Tips for SOCLess Oncall
  28. @ramimacisabird πŸ”— ramimac.me Detection ( Engineering): Canaries The Security Canary

    Maturity Model 1. Coverage: Diversity and Distribution 2. Impact: Signal and Cost Imposition 3. Management: Deployment and Maintenance 4. Program: Discoverability, Publicity, and Response Planning
  29. @ramimacisabird πŸ”— ramimac.me Deployment Mike Ruth β€’ Attacking and Defending

    Infrastructure with Terraform: How we got admin across cloud environments β€’ Attacking & Defending Supply Chains. How we got Admin in your Cloud, Again
  30. @ramimacisabird πŸ”— ramimac.me 30 - 60 - 90 Plan β€’Assess

    β€’Build relationships β€’Establish baseline
  31. @ramimacisabird πŸ”— ramimac.me 30 - 60 - 90 Plan β€’Do

    one thing better β€’Nail it β€’Add invariants for your baseline
  32. @ramimacisabird πŸ”— ramimac.me 30 - 60 - 90 Plan β€’Plan

    for scale β€’Reproducible process β€’Security ROI β€’Kill a class of risk
  33. @ramimacisabird πŸ”— ramimac.me Security Platform Engineering Team Cadillac CDR w/

    IR Retainer Cadillac β€œCNAPP” Actioning expensive log sources Data Perimeter How to 10X Your Cloud Security ( With the Series D ) Asset Graph lyft/cartography
  34. @ramimacisabird πŸ”— ramimac.me Takeaways 1. Build guardrails, establish invariants, offer

    secure defaults, and kill areas of risk - don’t add to dashboards full of problems 2. IAM, Vulnerability Management, and Detection Engineering are prime candidates for limitation to desirable security 3. Collect the minimum viable data to inform investments and report upwards & outwards https://speakerdeck.com/ramimac/scale-cloud-security
  35. @ramimacisabird πŸ”— ramimac.me https://speakerdeck.com/ramimac/scale-cloud-security One last thing … I’m new

    to Europe and will be looking for a new role (and friends) shortly If you know of any cool companies or people, in Sweden and beyond, let me know! Thank you! https://www.linkedin.com/in/ramimac/
  36. @ramimacisabird πŸ”— ramimac.me Philosophy Some things just don’t work: β€’

    Absolute least privilege β€’ Centralized security review β€’ Centralized security authorship Jacob Salassi - Appsec Development: Keeping it all together at scale
  37. @ramimacisabird πŸ”— ramimac.me Account Architecture Richard Crowley - You should

    have lots of AWS accounts Richard Crowley - One giant AWS account is technical debt you can’t afford Corry Haines - AWS Account Layout Brandon Sherman - What I wished someone told me before going multi- account
  38. @ramimacisabird πŸ”— ramimac.me Account Architecture: Migrations Houston Hopkins - aws_organizations_migration_notes.md

    Matthew Fuller - Moving AWS Accounts and OUs Within An Organization - Not So Simple!
  39. @ramimacisabird πŸ”— ramimac.me Account Architecture: Baseline β€’David Levitsky, Olivia Hillman

    ( Benchling) - Launch Control - Automating a Security Baseline in the Cloud at Scale β€’nozaq/terraform-aws-secure-baseline β€’Chris Farris - primeharbor/org-kickstart
  40. @ramimacisabird πŸ”— ramimac.me Account Architecture: Handling Root β€’Scott Piper -

    Managing AWS root passwords and MFA β€’Greg Kerr, Brett Caley, & Matt Jones - yubidisaster: Building Robust Emergency Admin Access to AWS Accounts β€’Rich Mogull - OUs, SCPs, and a Root User Account Recovery
  41. @ramimacisabird πŸ”— ramimac.me VAM : Secrets Scanning β€’Source Code β€’Terraform

    State β€’Image file systems β€’CI/CD Systems β€’ … ramimac/aws-customer-security-incidents gitleaks/gitleaks Allan Reyes - Keeping secrets out of logs
  42. @ramimacisabird πŸ”— ramimac.me Configuration as Code: Secure by Default β€’

    Semgrep for Terraform Security: Secure-by-default modules β€’ asecure.cloud β€’ Semgrep for Terraform Security: Use Semgrep to evangelize secure-by-default modules
  43. @ramimacisabird πŸ”— ramimac.me Configuration as Code: Scanning β€’ Christophe Tafani-Dereeper

    - Scanning Infrastructure as Code for Security Issues β€’ Adam Cotenoff - Standardizing Terraform Linting β€’ Scan plans, not just HCL β€’ Brad Geesaman - Pipeline Precognition: Predicting Attack Paths Before Apply