Release Date: 12/11/2023 | Issue: 213
Know someone who'd find this useful? Forward this email

CloudSecList is a newsletter for busy professionals who want to keep up to date with the cloud security industry. Hand-curated by Marco Lancini.

Sponsor

Detect transitive access to sensitive Google Cloud resources
Transitive access via service accounts is a common security vulnerability in Google Cloud configurations. This in-depth guide explains transitive access, the permissions that allow it, and how to detect it using the Google Policy Analyzer or alternative methods.
It also provides best practices for securing service account keys and recommends a powerful tool for assessing IAM configurations to secure your Google Cloud resources.
Learn more!

This week's articles

Scaling Detection and Response Operations at Coinbase

A three-part blog series covering some of the strategies and systems that the CSIRT has implemented at Coinbase to investigate and respond to threats more effectively. #monitor

Terraform Security Best Practices

Post providing guidance for using Terraform in a secure way by reference to some security best practices around auditing Terraform configurations, managing access credentials, and creating DIY Terraform modules. #build #defend #terraform

Key Takeaways from the 2023 Kubernetes Security Report

Get the key highlights from the 2023 Kubernetes Security Report, which analyzed 200,000+ cloud accounts to break down the state of Kubernetes security. #attack #defend #kubernetes

The Triforce of Initial Access

The article emphasizes that the success of Red Teaming often hinges on the quality of information (loot) gathered and the effectiveness of the tools used, such as Evilginx, ROADtools, and TeamFiltration, complemented by the Bobber script. #attack #azure #saas

A Comprehensive Guide to Testing in Terraform: Keep your tests, validations, checks, and policies in order

You have many options to use when it comes to testing and validating your Terraform configurations and modules. The newest addition to these options is the native Terraform testing framework. This in combination with custom conditions, check blocks, and policies allow for creating robust infrastructure-as-code. This post is a comprehensive guide to testing and validation in Terraform. #build #terraform

Secure Application Communications with Mutual TLS and Istio

Post discussing the requirements of secure communication among applications, how mTLS enables and meets all those requirements, along with simple steps to get you started with enabling mTLS among your applications using Istio. #explain #istio #kubernetes

Weather Forecast: Money Is Going to Rain from the Cloud

SafeBreach researchers discovered and exploited a billing flaw in Azure Automation Service, enabling free, hidden, and unstoppable cryptocurrency mining using Python scripts and Runbooks. #attack #azure

Spoofing Microsoft Entra ID Verified Publisher Status

It was possible to manipulate the consenting process of a legitimate verified publisher application to implant malicious unverified applications within a Microsoft Entra ID tenant. #attack #azure

Sponsor

Give Your GRC Some TLC
Simplify your security and manage compliance 80% faster with automated evidence collection and control monitoring.
See why 3,200+ customers choose Drata to automate compliance for SOC 2, ISO 27001, GDPR, and 14 other frameworks with none of the manual work. That’s right—no screenshots or spreadsheets. Plus, you get a real-time view of your compliance status so you’re never caught off guard before an audit.
Want to see the automation in action? Request a demo to get 10% off and waived implementation fees.
Get a Demo

Tools

kube-audit-rest

Kubernetes audit logging, when you don't control the control plane.

FARA

Repository that contains a set of purposefully erroneous Yara rules. It is meant as a training vehicle for new security analysts, those that are new to Yara and even Yara veterans that want to keep their rule writing (and debugging) sharp.

aws-ml-opt-out

A Terraform module that makes it a snap to opt out of all AWS AI/ML data harvesting.

Session-Hijacking-Visual-Exploitation

Session Hijacking Visual Exploitation is a tool that allows for the hijacking of user sessions by injecting malicious JavaScript code.

sso-sync-to-amazon-rds

Automatically provision database users from SSO.

MTKPI

Multi Tool Kubernetes Pentest Image.

CloudSecDocs

Activate GCP

Step-by-step instructions (with screenshots) for activating GCP in a Google Workspace account.

From the cloud providers

#AWS Amazon EC2 Instance Metadata Service IMDSv2 by default

Effective mid-2024, newly released Amazon EC2 instance types will use only version 2 of the EC2 Instance Metadata Service (IMDSv2).

#AWS Build an entitlement service for business applications using Amazon Verified Permissions

A comprehensive and centralized approach to managing access policies, reducing administrative overhead, and empowering line-of-business users to define, administer, and enforce application entitlement policies.

#AWS How to create an AMI hardening pipeline and automate updates to your ECS instance fleet

How to create a workflow to enhance Amazon ECS-optimized AMIs by using the CIS Docker Benchmark and automatically updating your EC2 instances in your ECS cluster with the newly created AMIs.

#AWS How to improve your security incident response processes with Jupyter notebooks

How to automate the tasks of gathering data, presenting the data, and providing procedures and next steps for the findings.

#GCP Introducing ransomware and threat detection for Backup and DR in Security Command Center

Powerful new rules in Security Command Center Premium can help customers quickly identify and remediate threats to backup and recovery infrastructure.

#GCP Introducing Advanced Vulnerability Insights for GKE

Artifact Analysis in partnership with Google Kubernetes Engine has introduced a new vulnerability scanning offering called Advanced Vulnerability Insights.

#GCP Google's AI Security Framework

Google introduced the Secure AI Framework (SAIF), a conceptual framework to secure AI systems.

#GCP Get real-time notifications on IAM privilege grants in Google Cloud

Using Cloud Asset Inventory, Pub/Sub and Cloud Functions to generate real-time notifications for IAM policy changes.

Business News

Thanks for reading!

If you found this newsletter helpful, I'd really appreciate if you could forward it to your friends and colleagues! 👌

If you have questions, comments, or feedback, let me know on Twitter (@lancinimarco / @CloudSecList), or at feedback.cloudseclist.com!

Thanks,
Marco

Forward