Best Defense? Good Cloud Offense

Originally published by Cloudtango here.

Written by Jordi Vilanova, Cloudtango.

Ever since cybersecurity began in the 70s, the focus was always building a good defense as part of the main strategy. The problem with conventional security has traditionally been its reactive nature to security, such as patching software, finding and fixing system vulnerabilities and other type of responsive actions to protect the infrastructure. As years went by, it was soon evident that this practice was not enough to provide solid security mechanisms that would anticipate security breaches, so organizations started to learn that preventing is always better than cleaning up the mess.

Over time, a new strategy started to emerge focusing more on the offensive rather than the defensive end. Offensive security has become nowadays a proactive and adversarial approach to securing cloud environments and networks from attacks being one the most used strategies as it has proven extremely effective at deterring attacks.

Today, many Linux OS systems come with a range of available options for digital forensics and penetration testing built-in such as those found in Kali Linux or Parrot OS. These type of environments highly facilitate to roll out an offensive security strategy across the network. There is a good reason why these built-in kits are so popular, they are extremely effective.

The purpose of an offensive security strategy is to develop processes for discovering vulnerabilities, prioritizing them, and creating a mitigation strategy. The techniques most often used to reveal vulnerabilities combine vulnerability assessment along with penetration tests. Conducting a vulnerability analysis may not be always a fully automated process, but for the most part these tasks can be deployed on a cloud environment with a range of different tools available, some of which are listed below.

Tools and Resources

AWS

A great resource published by haax details Cloud Container Attack tools for testing the security of AWS container environments, open source tools, cheat sheets, auditing tools, and more.

Azure

Microsoft recently published its Azure Threat Research Matrix for documenting tactics, techniques or procedures used against Azure services. This new Matrix was inspired from the MITRE ATT&CK knowledge base. The goal is to visually see what techniques were successful so you can understand the techniques that were performed in order to remediate or defend against them in the future.

Google Cloud Compute

Marco Lancini lists a good range of auditing and offensive tools to help strength and check any GCP environment.

Kubernetes

There are several possible Kubernetes services that you could find exposed on the Internet (or inside internal networks). In this site you will find a good number pentesting options ranging from enumeration, to role-based access controls.

Oracle

A security assessment overview published by Oracle provides you an overall picture of your database security posture. It analyzes your database configurations, users and user entitlements, as well as security policies to uncover security risks and improve the security posture of Oracle Databases within your organization.

Additionally to the tools and threat analysis options above, security teams would be well-advised to develop new skills and to learn by practice.