AWS Community DAY Albertini-Ellan Cloud Security (1).pptx

cloud app security

1. KENYA

2. Hacked!!...Not again!!... A guide on Reducing your attack surface on AWS cloud Albertini/Ellan | 20 th April 2024 KENYA

3. Albertini Francis Cloud Security Engineer Cloud Native security enthusiast AWS Community Builder: Security & Identity Gamer, Basketball Presenters Ellan Wambugu KENYA Solutions Architect DevSecOps Engineer AWS Community Builder : Machine Learning A stressed-out man united fan

4. Cloud Security???

5. Recent Cloud Breach Victims Football Australia Vectors : embedded cloud access keys & Public s3 bucket containing PII: player passports & contracts Capital one Vector: misconfigured Firewall leading to SSRF Led to the loss of 100 million records KENYA Cisco WebEx Vectors : Long term credentials & non-decommissioned access by a resigned engineer

6. Major Vulnerabilities in the Cloud Limited Visibility Misconfigurations Insecure APIs Secrets mismanagement: Embedding, stolen credentials Insecure IAM Storage Application vulnerabilities leading to breach e.g. SSRF KENYA

7. Attacker View of your Application Hackers look for the following breach points Assets i.e. underlying cloud Application Vulnerabilities Secret scanning on app, Code repository 3 rd Party personnel KENYA

8. So how do I not become the next cloud sec breach headline???

9. Major Guidelines Threat model i.e Assumed breach perspective Cloud Security is Modular & a continuous process Build Secure from the start i.e secure architecture There is no silver bullet… you can’t just throw money at the problem KENYA

10. Actions to Implement Establish Visibility & drift detection Automate & orchestrate everything!!!!!... Well.. Almost everything!! Implement Configuration Management Establish comprehensive IAM policies, provisioning and deprovisioning practices Secrets management Implement workload Security KENYA

11. Holistic cloud security program KENYA

12. Cloud Security needs to be a major in organization, done well it could be the best asset but neglected will bleed you Demo time Albertini/Ellan | 20 th April 2024 KENYA

13. Cloud Security needs to be a major in organization, done well it could be the best asset but neglected will bleed you Q & A Albertini/Ellan | 20 th April 2024 KENYA