hi welcome to
my talk i know who has access to my
cloud do you
i'm miguel fleckman i'm an identity
security engineer with years of
experience building products
for identity and pki management at
microsoft and after a few years i
decided to leave and co-found ketos
where we do
we make it easy for companies to become
passwordless with easy-to-use pki
solutions and there's my twitter if you
have any questions i'll be in the
discord
and i'll also be on twitter so feel free
to message me wherever you prefer
and i'll also be in vegas so if you want
to swing by and talk to
me in person like let me know and here's
a picture of me outside so it looks
like i do stuff outside and it's not
just coding all day
uh so let's just jump right into it with
a controversial topic
uh why security reviews suck so
one of the main things is it's based on
what you think your infrastructure looks
like
so it might be you you forgot to close a
port
and you know in the review you go and
say like now all my
ports are closed or you might say this
is encrypted and it's not actually
encrypted
and it also doesn't change over years
i've seen teams that have gone
over and over again with the same
diagram and did not
update it to the new microservices they
added or they completely changed the
platform
and we just kind of like assume that
it's still working
and i've also seen some security
professionals that care more about the
actual
diagram than they do from the security i
actually was blocked once
uh until i put a box around my
items to show that everything was
running in azure when it was
logical that everything was running in
azure so
let's talk about how hackers actually
get in and
it's a hacker talk so i had to put a
black guy
a guy in a black hoodie and um
let's talk about the first one that is
adding a member to a group
so this one is pretty easy like once you
get access to a group and you add your
identity to that group
it's pretty hard to detect because you
might have like your engineering group
that you add
to all your azure resources and you're
not really checking it that often you
don't change engineers that much so like
you're not going to be checking the
membership so it's an easy way to get in
and when you're checking our back and
everything you're not really gonna check
for
the group members another one is adding
an azure
classic administrator so azure classic
administrator is something that they
have been trying to get rid of for like
four years now
i think and now they put them into a
different tab so it's harder to add but
it's also
harder to detect if someone adds someone
and and you don't
notice the third one is adding a service
principle as a contributor to a
subscription
this was as a pentester one of my
favorite ones to do you just add
deployer
to the end of the service principle and
no one is going to touch it because no
one wants to break deployment so
once you're in you're in forever and you
will usually have like high
contributor owner access the next one is
removing a the only sql authentication
that one i haven't really seen but
we're actually forcing everybody to in
in my company to
use aad authentication for sql and we
don't want people to revert back into
using sql or
creating their own passwords and
everything so we added that check to
make sure that
everything is secure
and then another one is adding
permissions to azure
act uh akb policies
so basically you might have good
segregation of duties having
different applications having different
access to certain secrets some might be
able to get them some others
might be able to create them or delete
them but if someone
manages to compromise one of those
accounts and give themselves
access to everything then when you look
at the
access policies you still see the same
application so you don't see anything
different but they might have more
access that what they didn't need
and the other the last one i'm going to
talk about is adding ip addresses to the
firewall
so most companies have hundreds of ip
addresses
either from like your microservices that
talk to your service or you might have
your corporate vpn that has access to
it and adding one extra one either being
like a developer being lazy and adding
their home address
or a bad actor adding their address so
they can access
the system is something that can go
unnoticed
so the solution we created cloud watcher
cloud watcher
is a powershell module that runs on
azure automation
it's actually in the azure gallery so
you can just go there and download it i
have instructions at the end of the
slides it scans your subscription and if
it detects
any configuration changes that i just
mentioned
it will fail the script and then you can
send an alert we have it that like it
emails
uh sorry calls our on-call engineer and
let us know and here you have a run
that it shows how it's uh when there is
no changes detected
and here's a run that it tells you that
there were changes detected so we'll
tell you exactly what it found like
resource providers changed and
rbac changes and it will fail the round
book so then you can have like
azure automation like call you or like
send you an email
whatever you want it to do so let's talk
about what we actually cover
so arbex changes any hour exchange
adding removing
changing well it would still be adding
or removing
our back we'll catch it classic
administration
changes so you don't have to keep
looking for them we'll look for them
azure resources providers so azure
resource provider is something that i
didn't really talk about but that's
basically
how azure gives for example key vault
access to your vms to be able to encrypt
their disks
so it's kind of like another way that
you can create your custom providers
that
will give you certain access to the
subscription so we we like to keep that
blocked to whatever we are comfortable
with in our baseline
resource creation or deletion we don't
want developers to create kind of like
their own vms or something in the
production subscription that it might
endanger the rest of the subscription or
delete something by mistake that might
be like your availability zone or
something so we want to detect on
any resource creation or um or deletion
we also have the change of group
membership that won't
there's an asterisk because we only
check first degree so if you have nested
groups we don't go through each group
and check
all their groups membership we just
check the membership of the first group
of
of any group that is i called anywhere
in your subscription from our back to
ade or sorry ada admins on sql
anything that we can find we'll add that
group and check it
sql firewall rule changes so if they add
or remove ips
sql server aad so basically i already
talked about it kind of like
if you change the aed only or if you
change the ad
administrator azure key volt
access policies changes and firewalls
so now let's talk about the elephant in
the room you i i can see you guys all
thinking
all right the guy was just talking about
azure security center so did i just
reinvent the wheel
and the answer is no you can have a
security score of 100
and still be vulnerable to these back
doors by for example azure security
center will tell you if like your
management port like port 22 is open
to the world but it won't tell you if
it's still closed but an
extra ip that is not in your corporate
ip address was
added so this one is an addition to
security center it does not replace
security center we use security center
and we also use cloud watcher
and then for the setup this is a great
image of how we actually
have it set up um we have multiple
subscriptions and they're
all talking uh they're all cloud
watching each other
and here for to simplify it i'm just
showing one of the cloud watchers
so you have this production subscription
that is the one that you want to
protect in this case then you have a
cloud watcher in the same tenant
that has reader access to this
subscription and hopefully this other
subscription has different identities
managing it so you don't have the same
admin
identities managing both subscriptions
and then you have the baseline we
actually have it in another tenant
that cloudwatcher only has read access
to pull from the
storage account and get the baseline
json and then
we run continuously every few minutes uh
to make sure that everything is still
the same and nothing has changed and if
a change is detected in any of the
subscriptions we'll
alert our engineers on it so
now let's talk about what's next what
what are the next things we want to
build
so one of the things is create a ui to
visualize your resources as i said
i don't think the security reviews right
now do like the best job on it
um i've never seen a red team go
against a security review and grab the
information from there they usually just
scanned
the actual infrastructure
so we want to create a ui to visualize
those resources and maybe add some
alerts saying like hey like we notice
that you haven't enabled sql aad do you
want to enable that
and or will you notice that you don't
have azure keyboard firewall rules and
just kind of
give you better ideas on how to protect
your
infrastructure add more resources so
right now we solely focus on sql and
azure key vault the reason for that is
those are the core for
our company but we want to grow it to
other azure services
and the last one is integrated with
gloomy terraform and
arm templates so basically we want to be
able to compare your baseline
to your infrastructure as code and read
the desired configurations to be able to
secure it from your desired
configuration to your baseline
to your actual infrastructure to make
sure all three match
and then thank you so much if you have
any questions please send them to the
discord
or send them on twitter uh here's a
github where you can find
the readme with all the information
about how to install it
and then we have the slides also we
posted them online
and we have a set of video that i
created on my youtube channel to
set you to guide you through all the
things you have to do if you prefer a
video other than
a written readme