Lessons Learned from Responding to Cloud Compromises
Jun 3, 2024
auto_awesome
Mandiant consultants Will Silverstone and Omar ElAhdan share insights on cloud compromise trends, living off the land techniques, extended attack surfaces, securing identities, third-party risks. They discuss the importance of strong multi-factor authentication, detecting potential attack vectors, and managing third-party risks separately.
Prioritize identity segmentation & MFA for better cloud security.
Secure endpoints used by admins with dedicated workstations.
Deep dives
Identity Segmentation and Strong MFA Methods
Prioritizing identity segmentation and enforcing strong identity controls, especially focusing on privileged accounts, service accounts, and end-user accounts. Implementing robust multi-factor authentication (MFA) methods, restricting MFA modifications, and registrations to trusted locations. Monitoring and limiting the scope of non-human or service accounts' authentication processes.
Endpoint Security for Administrators
Emphasizing the importance of securing endpoints used by privileged administrators to access cloud environments. Recommending the use of dedicated and hardened endpoints or privilege-secured workstations for managing cloud platforms. Ensuring higher visibility and implementing tighter detection mechanisms on these secure workstations to detect any malicious activities earlier.
Trust in Credentials, Devices, and Networks
Establishing trust in credentials, device authentication, and network access for users to enhance cloud environment security. Focusing on administrative users and ensuring trust in their credentials, devices, and network locations. By securing these three aspects, organizations can significantly enhance the protection of their cloud environments.
Mandiant consultants Will Silverstone (Senior Consultant) and Omar ElAhdan (Principal Consultant) discuss their research into cloud compromise trends over 2023. They discuss living off the land techniques in the cloud, the concept of the extended cloud attack surface, how organizations can better secure their identities, third party cloud compromise trends, and more.
Will and Omar's talk at Google Next: https://www.youtube.com/watch?v=Fg13kGsN9ok&t=2s
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode