Securosis Research

The Coming Cloudpocolypse: Disrupting the Cloud Shared Responsibility Model

Mon, 28 Apr 2025 00:00:00 +0000

Chris & Rich’s session at RSAC 2025 The Coming Cloudpocolypse: Disrupting the Cloud Shared Responsibility Model.

You can also find the Slides here

Defining Security Invariants

Thu, 09 Jan 2025 17:00:00 +0000

Note: This post has been revised to include the new capabilities released by AWS prior to re:Invent 2024.
You can also check out the re:Invent presentation we did with Securosis: “Security invariants: From enterprise chaos to cloud order” slides - video

Implementing Security Invariants in an AWS Management Account

Tue, 24 Dec 2024 19:41:28 -0500

I’ve spoken a lot about Security Invariants, but all of them have been implemented using Organizational Policies. That’s great, but organizational policies don’t apply to the Organizational Management Account (aka “payer”). So how does one implement invariants in a payer account?

AWS would tell you that you shouldn’t be giving anyone access to the payer account, so the need for invariants should be minimal. However, that doesn’t reflect the reality that AWS never protected its customers from themselves and prevented the enabling of Organizations or Control Tower in an account with existing workloads. I would say this is a failure of Customer Obsession and demonstrates Security is not the Top Priority. AWS would hide behind shared responsibility and blame the customer.

Regardless, there are many cases where workloads are in a payer account, and as a security person, you need to live with those workloads while protecting the rest of the AWS Organization. So, how do we build invariants into a payer account when SCPs and RCPs don’t apply?

Enter Permission Boundaries.

Security invariants: From enterprise chaos to cloud order

Tue, 03 Dec 2024 00:00:00 +0000

Rich and Chris’s session at re:Invent 2024 on Security invariants: From enterprise chaos to cloud order

Slides and an accompanying Blog Post that included the re:Invent releases that didn’t make it into our talk.

CloudSec Hero to Zero: Self-Obsolescing Through Prolific Efficiency

Tue, 07 May 2024 00:00:00 +0000

Chris & Rich’s session at RSAC 2024 CloudSec Hero to Zero: Self-Obsolescing Through Prolific Efficiency.

You can also find the Slides here. Read more about the Universal Cloud Threat Model in the research library.

The Universal Cloud Threat Model

Tue, 23 Apr 2024 00:00:00 +0000

The Universal Cloud Threat Model is a collaboration between PrimeHarbor Technologies and Securosis. It is a cloud-centric threat model to help organizations focus security efforts on the most-common attacks most organizations will experience. The UCTM is designed as an adjunct to other threat models. From the introduction:

Modernizing SecOps for Cloud

Fri, 23 Feb 2024 00:00:00 +0000

Security Operations, SecOps for short, has been one of the more difficult security domains to modernize for cloud. It requires a combination of new subject matter expertise, new technologies, process updates, and even a slightly different mindset. Cloud impacts SecOps in ways both obvious and subtle, and because most organizations still have datacenters and offices, teams need to add new skills and update operations while still supporting everything already on their plates. It’s a daunting challenge, but one that can be made much easier to tackle by distilling down, into the core of how cloud changes things, and taking lessons from the successes of early adopters.

Minimally Viable Cloud Governance

Wed, 14 Feb 2024 12:02:58 -0500

You are multi-cloud whether you like it or not.

Most organizations have a preferred cloud provider. This is the provider where they have the most engineering expertise, have negotiated the best discounts, and have built the paved road experience.

Deploying AWS Backup

Tue, 05 Sep 2023 09:23:37 -0400

tl;dr - here is a link to the scripts

What Ransomware in AWS looks like

In a typical ransomware attack, a threat actor will attempt to encrypt files on critical machines belonging to the victim. In exchange for a cryptocurrency payment, the threat actor will provide the decryption key and software to the victim, who then has to go through the arduous process of restoring their machines. The encrypted data is typically lost forever if the victim refuses to pay the ransom.

Leveraging AWS SSO (aka Identity Center) with Google Workspaces - version 2

Sun, 25 Jun 2023 18:25:26 -0400

This is a revised version of the original post Leveraging AWS SSO (aka Identity Center) with Google Workspaces based on the new announcement AWS IAM Identity Center now supports automated user provisioning from Google Workspace The original post is still valid, and in someways may be better, but this version has it’s own advantages.

Setting up AWS IAM Identity Center (successor to AWS Single Sign-On), hereafter called AWS SSO (because I have to pay AWS for egress on this site), is an excellent service to help you get rid of IAM users and enforce identity best practices around second-factor authentication, on and off-boarding employees, and assigning the right level of access depending on job function.

Companies using Google Workspaces for email and collaboration can also leverage their Google accounts to access AWS via AWS SSO. The process isn’t clearly documented, and the provisioning support isn’t integrated, so here is a post to help you set it all up.

Leveraging AWS SSO (aka Identity Center) with Google Workspaces

Sat, 27 May 2023 06:25:26 -0400

Leveraging AWS SSO (aka Identity Center) with Azure AD

Tue, 16 May 2023 20:33:45 -0400

Setting up AWS IAM Identity Center (successor to AWS Single Sign-On) henceforth called AWS SSO (because AWS charges for egress), is an excellent service to help you get rid of IAM users and enforce identity best practices around second-factor authentication, on and off-boarding employees, and assigning the right level of access depending on job function.

Cloud Penetration Tests

Sat, 15 Apr 2023 11:00:04 -0400

This past weekend I spoke at BSides Nashville on offensive operations in AWS: Get outta my host and into my cloud. While I was finishing the talk, Nick Jones published a blog post of his own: On AWS Penetration Testing.

Incident Response in AWS

Sat, 27 Aug 2022 12:50:04 -0400

At BSides Atlanta today I gave a talk on how to handle an incident in AWS. The talk and this post is intended to help those already familiar with the principles of Incident Response to understand what to do when the incident involves the AWS Control Plane. You can find the Slides here.

The Cloud is Dark and Full of Terrors

Sat, 02 Oct 2021 00:00:00 +0000

Chris’s presentation to BSides Augusta in 2021 - The Cloud is Dark and Full of Terrors

Slides and Blog Post are available.

Data Security in the SaaS Age

Sat, 26 Jun 2021 00:00:00 +0000

Data security remains elusive. You can think of it as something of a holy grail. We’ve been espousing the idea of data-centric security for years, focusing on protecting the data, so you can worry less about securing devices, networks, and associated infrastructure. As with most big ideas, it seemed like a good idea at the time.

Securing APIs: The New Application Attack Surface

Sat, 26 Jun 2021 00:00:00 +0000

The way applications are built, deployed, and maintained in most organizations is being disrupted. Macro changes include the ongoing cloud migration disrupting the tech stack, new application design patterns bringing microservices to the forefront, and DevOps changing dev/release practices. As we’ve been slowly navigating this sea change, the common thread across these changes is increasing reliance on Application Programming Interfaces (APIs).

Security Hygiene: The First Line of Security

Sat, 26 Jun 2021 00:00:00 +0000

After many decades as security professionals, it’s depressing to keep seeing the same issues and mistakes. It feels like we’re stuck in hacker Groundhog Day. Get up, clean up the mistakes made by users or administrators, handle a new attack, and fill out compliance reports, only to have to do it all over again the next day.

Enterprise DevSecOps

Tue, 10 Dec 2019 00:00:00 +0000

This is our latest iteration on how to build a DevSecOps program. This research paper is the result of hundreds of hours of research and several hundred conversations with Fortune 1000 firms on the challenges companies face and the problems they are most interested in tackling. We go deep into covering all phases and facets of secure application development. And we did a complete reversal on the naming convention; from DevOps to DevSecOps. It became obvious during our calls that despite the idealism involved with leaving ‘Sec’ out of the title, security is getting short shifted and it needs to be called out.

Understanding and Selecting RASP 2019 Research Paper

Tue, 19 Nov 2019 00:00:00 +0000

So what is RASP? Runtime Application Self-Protection (RASP) is an application security technology which embeds into an application or application runtime environment, examining requests at the application layer to detect attacks and misuse in real time. RASP functions in the application context, which enables it to monitor security – and apply controls – very precisely. This means better detection because you see what the application is being asked to do, and can also offer better performance, as you only need to check the relevant subset of policies for each request.