hi everyone
my name is henry cannabill and this is
my session how do you
all the clouds in this session
i'd like to cover a number of different
things first is base planning and
understanding
for your cloud and adoption needs the
second one
is to establish common security issues
for your teams and organizations that
you support
or for yourself as you're deploying your
workloads onto
a cloud environment the third is
recognizing your stakeholders and
partners throughout the journey
as you're maturing the process and
adoption of your cloud environments
and finally where the focus of this con
of this conversation i'd like to have
with you
is to introduce security tools insights
and perspectives
i am going to presume that a lot of you
are not as familiar with
how to really take advantage of the
cloud and so we'll talk about
some of those things and um what kinds
of tools that i want to share with you
that
could really help you on the journey so
some quick information about myself
my name is henry canval i've been a
security architect
for the last several years i've been a
security professional for
five plus years i come to you as a
former developer
i used to develop uh c and c plus plus
in java
about 10 15 years ago and now i kind of
do python on the side or
as part of my role as a security
architect
one of the hats i like wearing is um i'm
a data security
specialist within my company within my
team and so
more now that the potential role of a
log czar
really sounds kind of fun to me um
location-wise i'm
i'm from the bay area i live now in l.a
for the last few years and a few
uh these are a few of images i like to
uh encapsulate
my personality so
our talking target audience for today i
wanted to
address the it professionals and
engineers
that are deploying uh compute workloads
rather through uh cloud functions
or app for containerized applications or
even just straight up
vms to deploy uh you install software
onto it
i'd also like to help address the
security professionals that
are not as familiar with cloud and
how to provide them to enable them with
better tools as part of their advisory
roles
so what's the plan for today
to first address i want to clarify for
everyone
that i'm not trying to target a cloud
migration strategy to go through the
details of
why you should or shouldn't go move to
the cloud
i also don't want to focus on the
workload planning of how you migrate
your applications
uh from traditional software to cloud
taking advantage of cloud tools and
services
um this is also not an incident response
or application security type of talk
however i do want to focus on the
various cloud security challenges
organization
when you talk about cmmi that stands for
the capability maturity model
integration
it's a traditional framework for
application and software
development i want to apply it for cloud
adoptions
um thirdly i want to cover uh how to
for your teams to get started in
securing
your cloud adoptions more effectively
fourth i want to provide some strategic
and tactical recommendations
for the audience and finally providing
some tools and solutions to help you on
your journey
so when we talk about general cloud
challenges these are
pretty much the four pillars for any
organization
for any type of projects you look at
security
and general it's pretty straightforward
you look at the governance privacy
control your compliance programs your
legal
uh your legal teams as as they are your
consultants or your consultant or your
informed constituents
and stakeholders third we talk about
interoperability
how to deploy your systems and
applications to work efficiently
and to collaborate effectively across
multiple cloud platforms
the idea is to focus on the ability to
support a multi-cloud provider
environment for your enterprise and
finally
uh that sometimes uh kind of creeps up
with you
would be your cloud spend management
either for security or non-security
purposes
your finance teams are heavily
interested in how much you use your
your cloud probably focusing on security
challenges these are a number of
different areas that i've
discovered and have learned and worked
with over the last
five to ten years the first one i wanted
to emphasize
is the sprawled cloud accounts and also
the adoption of
multiple cloud service providers
oftentimes you have a lot of users that
just
i have an idea i want to push it up
there it's proof of concept
and you have over time a number of them
hundreds of them
maybe thousands the second area i want
to focus on
is uh at least at a high level is pretty
much configuration
and add to inadequate change control
you talk about you're protecting your
environments
when you enable your it professionals
your
your sales engineers
your and other
general engineers they can build their
own environments they like to believe
running their own virtual data center
there found some cost
in terms of operational overhead how do
you enable them
third one i talked about attribution i
want to make sure it's
when you talk about attribution we're
talking about account ownership
points of contact if your instant
response
um pretty much effectively providing a
reliable identity and asset management
for a number of people that need to
triage an insulin for example
and so with the rest of them they're
effectively around visibility and
control
of understanding how your projects are
being managed and deployed within your
cloud compute environments
in the end how do you make that visible
for a number of people
more than just your engineers and
professionals that are running
uh self-servicing their own cloud
services
so when i talk about the cloud maturity
model integration
this framework has been traditionally
focused on application developments
and deployments and so we talked about
these five different areas we have
initial managed to find quantitatively
managed optimizing
most environments um when you're
deploying software
it's pretty much again like proof of
concept thing uh
to all the way to something that's
really snazzy something that's really
taking advantage of cloud environments
um sorry to take advantage of their
software the tech stack
so we want to adopt this to to uh cloud
as well
so when you talk about the cloud
adoption journey we have these
these areas as well projects deploying
projects
typically that means a proof of concept
i have an idea
i want to run it somewhere else i don't
have a data center or maybe i just want
to stand up really quickly and show that
we are capable of writing an application
in this in a new environment
when you talk about foundation it's
pretty much like a lift and shift moving
it over
that you are using cloud it's it's not
your data center anymore
but it's the application you're really
aware it just still kind of runs
properly and so um you're you're pretty
much the basis of your enterprise
applications
we talk about migration we're talking
about uh
how much of uh application has been
moved over
uh much of the the dependencies on your
applications
that are using cloud services but uh
you may not necessarily be aware of it
and finally reinvention rebuilding the
application itself
so these cloud migration strategies i
just talked about lift and shift
refactor rebuild in different ways lift
and shift is
typically when when you have your
application workload
um you're still leveraging you're
minimizing the type of changes
on your applications and moving towards
uh moving your legacy systems and
applications
and you're not really taking advantage
of cloud you're just moving it to a new
virtual space if you will and so with
each of these come with varying levels
of flexibility and effort for a reason
for lift and shift this flight's very
low you just want to pretty much
swap your software into a new
environment from the data center
or some other data or some other cloud
environments to a personal one to
something that's managed by the iot
organization but you're not really
changing much
we're talking about refactoring that's
where i mentioned about back in this
slide about plantation
where we talked about refactoring a
little bit into using uh
new tools or new back-end software for
example
and then rebuilding when you're actually
taking advantage of things like
auto scaling and when you descale as
well
or as drawing passwords with the kms
that the provider uses that
you're not using something a little more
dynamic and can be
with your compute systems as well so it
takes more effort to put into it but at
least uh fits all your
uh your flexibility flexibility needs
so when we talk about cmi that's where i
want to adapt this for
cloud adoption where i see proof of
concepting where
that's where i talked about here with
projects early in the stage it's part of
the initial adoption of
cloud of cloud services then you kind of
go through the gradient of
becoming until you're optimizing really
taking advantage of
cloud services
for this talk as well we target the
audience and the trajectory
for where where are you typically and
for this talk i want to focus
on the the stage from foundational to
migration
when you're from lift and shift to
refactoring
what are the things that you need to
take advantage of at
one when you're when you're leveraging a
lot of these cloud services
do you have visibility to it can you see
it
can you extract enough information and
centralize it
for areas or tools that you use already
so we talked about security there's four
different areas
you want to protect and it starts with
your infrastructure
your applications themselves your data
and your people
keep in mind because these four topics
these are very important for
especially privacy teams from legal
your compliance teams your i.t teams and
then your engineer
so covering a number of different basis
so for security clouded options um
as the security professional these are
the 10 different things i look for
when looking at the objectives and
how you're protected and how do you be
more
cloud specific and so i want to uh i
don't i'm not going to go through all
these in particular but
uh the first two at least just basically
taking advantage of of cloud it's really
easy to scan and be dynamic in a cloud
environment so you have to
match that and how you you have to build
that in early
once you've done the lift and shift how
do you update
and aggressively challenge your
processes
so next few slides we're going to kind
of i'll just kind of
blow through them really quickly since
that's the focus
in a cloud environment model it's always
shared
the shared security models so you talked
about
who's responsible for what on a cloud
platform
so as i mentioned before about uh people
data applications infrastructure there
is a breakdown and so
it's all the responsibilities for the
cloud provider a lot of it is on the
organization using
you as a customer using the platform
so when you talk about multiple cloud
services here
are a number of different tools
across the different uh software
services um
uh cloud providers aws azure and gcp are
the the three top most ones and so
you break it down into compute services
database services
storage services networking services
here's a number of different
um when you the products for each
service
for each cloud provider
from the security perspective
specifically the different
these are the different areas that you
would want to focus on for each types of
cloud service we bring
back to the stakeholders as i mentioned
earlier here's a further breakdown
with including the common descriptions
and common rules i leave it to you to
check this out
either here or after the
presentation so when you look at
protecting your environments i like
referring back to technology tools and
processes
the technology refers to the
capabilities of the technology the csp
provider
or what or uh pretty much what do they
offer natively
what types of features and capabilities
like auto scaling is a simple example of
it
or some sort of ins or credential store
in terms of tools what do they offer
the csv itself or other third party
providers
and thirdly in terms of processes what
um
your own processes of your solution of
management of
what are areas that when you manage the
environments what are your choke points
and
uh you need to cost them and also
identify how to improve them
so in terms of simplification i want to
focus on the tools that's why i
mentioned a few times on this slide deck
the hardest thing to is to identify the
biggest pain points
and also how to optimize them so there's
a number of different topics in terms of
devops
that really focus on optimizing
inefficiencies
and so when you programmatically target
those it's a lot easier to
scale out your operations your time
pretty much
so when you talk about tools i i pretty
much have this
um basic formula build versus buy and
then
time drop rate that helps define your
tcl your total cost information
from a strategic recommendation
perspective i want to provide a number
of different areas that
help you drive success you want to
work with you want to enable visibility
for your organization
you want to run tools more easily you
want to expand
coverage for the different tools and the
different
services that you're leveraging um we
also want to make sure that
uh you extend your current capabilities
your tools your skill sets uh
in terms of tools like sim in terms of
cornell
you have a number of people that are
that you're that are your sysops
do you have particular strengths in
different areas uh optimize
your time pretty much other areas for
consideration
i list over here how are you what are
your dependencies
um some of these tools are they actively
maintained
uh what kind of support levels uh
support models are they offering
do they have a freemium model so you can
try before you buy
things like that for
common cloud security solutions um i
categorize them to these three areas
these theme are these are pretty common
when you talk about
migrating to the cloud um these are
three different
type of security strategies um or
solutions
to monitor based on the different types
of
activities or usage of it cwpp uh you're
focusing on your workloads
you can talk about containers or cloud
functions
how they're often they're being executed
from where how who's triggering it
access control
things like that cspm i focus on
generally
i talk about posture management
and that mainly focuses on configuration
and your your surface area your attack
surface area
tasty is another one a lot of providers
focus on file handling and exposure and
sharing for example i like focusing on
access control and reinforcing
those types of policies
other things to also consider for modern
considerations for cloud
modern computer workflows
one of the things i feel is understated
when you talk about devops
one of the biggest focus for that is
infrastructure is code
however when you talk about
infrastructure as code now you're
exposing your infrastructure
if you misconfigure um an api
uh resources that may enable
a certain attack vectors but if it's
infrastructure
then you're talking about exposing
entire services
um port ranges is a simple example of it
uh the second thing i want to make sure
everyone understands is that
most if not all clouds are cloud sorry
cloud service providers they presume
their default configurations and wizards
are not safe by default uh the azure and
um gcp and aws when you go through
training
they focus on the ease for the it
professional or any professional
to stand up a workload but they are sure
to always correct themselves
saying like don't use a default so keep
that in mind
so technical recommendations for this
the rest of the talk
i want to focus on research tool
discovery
and how you can attest or stage your
progress
in terms of research i provide for the
rest of the talk it's pretty much
providing you a number of different
links so you can research and kind of
review these types of tools on your own
in different talks um if you're new
or or not as comfortable with cloud
security and you need some ideas
um what is entail uh what how do you
discover new tools
how do you discover new perspectives i
would
push towards um these are a sampling of
different
uh websites uh one of my favorites is
tldr
sec every week he sends a newsletter and
compiles a number of different tools
across
it's it's targeted initially for um
the application developer however uh
for absent purposes but they also cover
a number of different things so
container security uh cloud security
vulnerability management it's pretty
much the entire gamut
and so you can list a number of
different tools so it's a wonderful
resource
another one that i recommend is tony
blitz his repo my arsenal of aws
security tools he also built a tool
called crowley
so it's pretty good stuff so it's very
exhaustive a number of different
resources tools uh code scanners all
these different things that are mostly
open source they can try yourself
aquaset they they offer a premium type
of products
but they have wonderful content
regarding how to train and really
understand cloud security
and so i gave you an example here with
their cloud security scanner
there's a number of different links that
they have to cover the different topics
so i highly recommend those
and the last one i do want to share with
you is chaos monkey
while it's not specifically security
netflix has been in the game for
cloud adoption for a long time they've
identified a number of different
problems strategies deployments
and they want to share a lot of their
tools chaos monkey is an old tool that
was focused on
this concept of chaos engineering if how
do you
build more resilient processes and tools
so if part of your environment goes down
your stur
your service still runs properly and so
they like send that to
uh security monkey and then uh security
guerrilla
to do a lot of those things of detection
and remediation of
things that are bad for your environment
so
check those out um the other thing for
research i want to emphasize is the
attack vectors
the different types of attacks on your
environment are completely different
than data center
you've seen aws misconfigure
a certain setting and taking down the
half the web
half the internet because a lot of them
were using s3
as part of their web hosting so
that opens a new kind of forms um the
miter framework i'm just going to focus
on leaving these two here
that they've adapted their attack
framework into two ways one of them is
for
cloud specifically and two instead of
standard attack the from the attack
perspective flipped it over for
defend and so there's a link for that so
you can see how it
kind of pivots and how you can defend
your environment as well
so other areas of consideration uh these
are different tools i mentioned earlier
and you can
rephrase you can leverage them over here
as well
for tools i want to share with you csp
cloud service provider that are native
to those platforms
gcp has two tools i like one of them uh
one of them's a generic link the other
one's for asset inventory
so they have a quick way of identifying
all your assets
i'm more familiar with aws so config and
audit manager rates
the im analyzer is also pretty snazzy
there's a number of different checks
from their credit reports uh the
iam credential report that you can also
port into different
tools that awps uses but the iem
analyzer is free of charge and you can
analyze
in verifying all the different aspects
so there's different ways
to determine your identity and entities
here's a number of different open source
and closed source tools
i list there's a lot of a lot of these
different tools to kind of reference
each other as well
kind of in a nested fashion because as
you realize
not every tool can cover a lot of things
so let's bring in a lot of things so
here's
here's an example uh one of my favorites
is scout suite
it can scan multiple uh environments and
see if it displays
oh no it doesn't uh there's a link i can
provide
if you go to scout's fleet um this this
link should pro
uh animated itself and so basically
those are reported and so
when you run it you can create an html
page and you can look at the different
checks faces off and for awfs or gcp or
sure
you have a set of security tracks
policies
that all assess against the
configuration
that's specific for the cloud and for
that provider
but also they look at it from cis as
well so it's great
i like using it for multi-cloud
environments
prowler is the one i mentioned by tony
blake's this is also
a linux based one to run and has a nice
ui as well
lastly i want to talk about simulation
one of the biggest things
um when you adopt new tools adopt new
cloud environments
it's really hard to recognize i did all
this project
i did all this work together i defined
policies i'm integrating and tightening
up my security groups
i reduced the number of publicly
accessible
services or storage i encrypted
my backups and my snapshots and my
and my um attached volumes but how do i
verify
it or how do i test my tools and so
these are a number of different tools
that
um that i think would really help you
kind of scale based on different use
cases
based on different um if it's
specific cloud or even you want to
extend it to kubernetes for example for
applications potentially
or how do you stand up environments that
are
actually bad by default uh sad cloud and
terra guilt are two examples of those
that you deploy
poorly configured environments then you
can test your
detection tools that scan
is tracking it properly so i highly
recommend those
um the last one flaws up cloud should be
awesome for you
that's kind of like the ctf you can
actually test and practice
your skill sets improve their skill sets
and also challenge yourself of
understanding
when when i see this how do i detect it
or what do i look for
so um that's pretty much it
so a lot of different videos i tried
throwing into in a quick 30 minute call
hopefully it's
not too much um i want to make sure that
you guys have enough information
to uh look back and kind of review your
what you've learned um how to best
partner with
if you're an id professional engineer
work with your security professional or
if your security professional
understand more of the different tools
and how to assess cloud if you're not as
familiar
so it's about synergy in the end working
with your organization so
in the end i'll make sure that you're
enabled with tools and
understanding what different processes
and to effectively work
smarter not quite so um
i'll be online obviously uh during the
talk uh thanks for having me
uh thanks to the bluetooth village for
everything if you have any questions
hit me up and there's a few other links
in the appendix as well
thank you