Hey folks!
On June 4-5th, we invite you to the conference Let's Talk #Security by DevOpsDays Ukraine community ⚙️

🛡 A two-day virtual event is dedicated to security integration throughout the IT lifecycle. We'll discuss context-based security, cloud hacking scenarios, information security in the cloud, defense against cyberattacks and the complexities of cyber warfare, vulnerability management implementation with AWS services, OWASP Top Web Application Security Risks, and more.

Presentations, ignite talks and open space discussion await you!

Check out agenda & register 👉 https://www.devopsdays.com.ua
When? June 4-5
Where? Online

Join for free!

AWS + CVE-2024-6387 (RCE vulnerability in OpenSSH)

Amazon Linux 2 - Not Affected ✅
Amazon Linux 2023 - Pending Fix ⚠️

https://explore.alas.aws.amazon.com/CVE-2024-6387.html

CVE-2024-6387 description:

https://www.wiz.io/blog/cve-2024-6387-critical-rce-openssh

Based on what is currently known about this vulnerability, Wiz Research estimates that widespread exploitation is unlikely.

The vulnerability has only been proven as exploitable under lab conditions on 32-bit Linux/glibc systems with ASLR. Exploitation on 64-bit systems has not been proven but is believed to be possible.

#security

Полезная ссылочка для вечных дискуссий о "небезопасности облаков".

https://www.abc.net.au/news/2024-07-04/amazon-contract-top-secret-australian-military-intelligence/104057196

#security

AWS for DORA (Digital Operational Resilience Act) =
• WAF (Well-Architected Framework)
• IAM
• KMS
• Shield
• Config
• Backup
• CloudTrail
• GuardDuty
• CloudWatch
• Security Hub
• Resilience Hub
• Audit Manager
• Trusted Advisor

https://d1.awsstatic.com/fs-compliance-center/pdf-summaries/AWS-User-Guide-to-the-Digital-Operational-Resilience-Act.pdf

#security

Длинный список реально хороших ресурсов по AWS security:

https://medium.com/@goodycyb/practical-checklist-for-aws-cloud-security-engineer-3271f9afb338

#security

Student SCP policy — политика для защиты аккаунтов, предназначенных для изучения AWS.

Покрыты все нужные сервисы, запрещены неадекватные действия по биллингу, запрещены действия, которые могут иметь долгосрочный и неотвратимый характер.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "StudentSCPpolicy",
      "Effect": "Deny",
      "Action": [
        "athena:CreateCapacityReservation",
        "aws-marketplace:AcceptAgreementRequest",
        "aws-marketplace:CreateAgreementRequest",
        "aws-marketplace:CreatePrivateMarketplaceRequests",
        "aws-marketplace:Subscribe",
        "backup:CreateLogicallyAirGappedBackupVault",
        "backup:PutBackupVaultLockConfiguration",
        "bedrock:CreateFoundationModelAgreement",
        "bedrock:CreateProvisionedModelThroughput",
        "cloudfront:CreateSavingsPlan",
        "devicefarm:PurchaseOffering",
        "directconnect:ConfirmCustomerAgreement",
        "dynamodb:PurchaseReservedCapacityOfferings",
        "ec2:AcceptReservedInstancesExchangeQuote",
        "ec2:CreateCapacityReservation",
        "ec2:CreateCapacityReservationFleet",
        "ec2:CreateReservedInstancesListing",
        "ec2:LockSnapshot",
        "ec2:PurchaseCapacityBlock",
        "ec2:PurchaseHostReservation",
        "ec2:PurchaseReservedInstancesOffering",
        "ec2:PurchaseScheduledInstances",
        "eks:CreateEksAnywhereSubscription",
        "elasticache:PurchaseReservedCacheNodesOffering",
        "elemental-appliances-software:CreateOrderV1",
        "elemental-appliances-software:SubmitOrderV1",
        "es:PurchaseReservedElasticsearchInstanceOffering",
        "es:PurchaseReservedInstanceOffering",
        "freertos:CreateSubscription",
        "glacier:CompleteVaultLock",
        "glacier:PurchaseProvisionedCapacity",
        "groundstation:ReserveContact",
        "iottwinmaker:UpdatePricingPlan",
        "iq:ApprovePaymentRequest",
        "mediaconnect:PurchaseOffering",
        "medialive:PurchaseOffering",
        "memorydb:PurchaseReservedNodesOffering",
        "organizations:LeaveOrganization",
        "organizations:DeleteOrganization",
        "organizations:RemoveAccountFromOrganization",
        "outposts:CreateOrder",
        "panorama:ProvisionDevice",
        "quicksight:Subscribe",
        "quicksight:UpdateSPICECapacityConfiguration",
        "rbin:LockRule",
        "rds:PurchaseReservedDBInstancesOffering",
        "redshift:AcceptReservedNodeExchange",
        "redshift:PurchaseReservedNodeOffering",
        "route53domains:AcceptDomainTransferFromAnotherAwsAccount",
        "route53domains:RegisterDomain",
        "route53domains:RenewDomain",
        "route53domains:TransferDomain",
        "route53domains:TransferDomainToAnotherAwsAccount",
        "s3:PutBucketObjectLockConfiguration",
        "s3:PutObjectLegalHold",
        "s3:PutObjectRetention",
        "s3-object-lambda:PutObjectLegalHold",
        "s3-object-lambda:PutObjectRetention",
        "savingsplans:CreateSavingsPlan",
        "shield:CreateSubscription",
        "snowball:CreateJob",
        "snowball:CreateLongTermPricing"
      ],
      "Resource": "*"
    }
  ]
}

Student SCP policy не имеет ограничений на адекватные действия и создание любых ресурсов, что могут потребоваться для изучения. Поэтому предполагается обязательная настройка AWS Budgets и алертов.

Если требуется более жёсткие ограничений, то нужно использовать Allow List Approach — вместо запрещения проблемных лишь разрешать нужные.

#security #organizations #scp

Пароли нонче в моде от 16 символов.

https://www.cisa.gov/secure-our-world/require-strong-passwords

#security

AWS VDP (Vulnerability Disclosure Program) is a standardized pathway to allow you to disclose vulnerabilities to AWS.

https://hackerone.com/aws_vdp

This is not a bug bounty but it has private bug bounty programs.

#security #VDP #BugBounty

fwd:cloudsec Europe 2024

https://www.youtube.com/playlist?list=PLCPCP1pNWD7Og_iduC9DzLo-9fH389_1y

P.S. Отдельно советую посмотреть Build Your Own CloudTrail, где про CEDAR, но не занудно, а интересно.

#security

MFA (Multi-Factor Authentication).

#security #пятничное