Steps to a successful GitSecOps approach

GitOps is an approach to perform cloud operations (in DevOps way) by centralizing the desired state of system into code and enforcing change through automation via version control system (such as Git).

Git acts as a common place where workflows, automation, checks and balances can be applied before entering a production environment, enabling organizations with a crucial foothold to secure by design further than ever before.

By adopting GitOps, it means it is a commitment to interacting only with Git and leaving the integration and deployment jobs to be automated.

By ensuring that everything is code driven and declared, the risk from non-automated agents (a.k.a. humans) can be drastically minimized. 

For example, using the automation workflows, you can embed compliance scans to enforce best-practices and regulatory mandates to prevent mis-configurations. With detection of configuration drift, it becomes easier and quicker to isolate vulnerable/compromised resources for investigation.

GitOps can leverage DevSecOps tools, such as IaC scanning, security testing, IAM and secret management. And by bringing a security-as-code and adding compliance requirements and security policies into coded artifacts, organizations can embrace GitSecOps to effectively shift the security left.

Seven steps to a successful GitSecOps approach:

1. Applying identity and access controls
2. Enforcing change control and peer review workflows
3. Observing end-to-end
4. Keep secrets safe (vault or eternal key managers)
5. Protecting audit logs
6. Catching the drift
7. Monitoring anomalous behavior
   

Just like DevSecOps, GitSecOps also requires the adoption of a new mindset and culture to getting things done in a cloud native way.

Sharing common tools, processes and goals — focused on a successful shared outcome rather than an isolated deliverable — ensures that the DevSecOps and GitSecOps goals are aligned to support each other and the organization’s digital transformation vision.

Links:

• Just when you had figured out DevSecOps, along comes GitSeOps
  

Cloud Security and DevSecOps Automation

Completed my training on SEC540 today. 

SEC540 provides me with a methodology to secure modern Cloud and DevOps environments. By embracing the DevOps culture,I'm able to walk away to build security controls witin the DevSecOps security program.

It is important to understand the DevOps toolchain and how to introduce security controls in their automated pipelines responsible for delivering changes to cloud-based systems. Without effective pipeline security controls, security teams lose visibility into the changes released into production environments.

Kubernetes Tutorials

Kubernetes tutorials with hands-on labs with certification at IBM.

This is an interactive browser-based training for deploying and operating a cluster on IBM Cloud® Kubernetes Service. No downloads or configuration required.

There 3 labs are available:

1. Containers and Kubernetes essentials  - To learn the core concepts of Kubernetes and how to use Docker containers on Kubernetes.
2. Scalable web applications on Kubernetes - To learn how to scaffold a web application, run it locally in a container and deploy it to a Kubernetes cluster.
3. Analyze logs and monitor application health - To learn how to analyze different types of logs and monitor the performance of your applications and clusters.

It is estimated to deploy and manage applications in a preconfigured Kubernetes environment available for four hours at no charge.

 

Links:

• https://www.ibm.com/cloud/kubernetes-service/kubernetes-tutorials
• https://developer.ibm.com/openlabs/iks
  

Cloud IMDS

Ryan post an excellent blog post about Cloud Instance Metadata Services (IMDS). This is misunderstood but deeply important feature to lock down when deploying workloads in cloud. IT could be a major blind spot for many security teams.

Every cloud instances (VM) can query its IMDS when it requires access to cloud environment.

IMDS is a REST API that is available at a well-known, non-routable IP address (169.254.169.254 or fd00:ec2::254).

AWS's IMDS has a default deployment that is vulnerable. 

$ curl 169.254.169.254/latest/meta-data/iam/security-groups
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/EC2S3FullAccess

 

Links:

• Cloud Instance Metadata Services (IMDS)
• Azure Instance Metadata Service (Linux)
• Use IMDSv2 - Amazon Elastic Compute Cloud 
  

Cloud Security for Beginners

A series of webinar that talk about cloud security.

Part 3:

• What a typical attack would look like and where to look for evidence of compromise
• How to put into place security controls to prevent the attack
• Where we can focus our efforts to increase the security of our cloud environment
  

Getting Started with Microsoft Defender for Cloud

Microsoft Defender for Cloud provides you with a Secure Score, which measures the configuration of the resources in your Azure subscription against the Azure Security Benchmark.

Defender for Cloud can also help you associate these various policies to compare your deployment and configuration.

This video provides a walk through of enabling Defender for Cloud for the first time and associating a compliance policy that is used to measure the security of the subscription.

Links:

• Microsoft Defender for Cloud documentation
  

Cloudlist - a tool for listing assets from multiple Cloud Providers by ProjectDiscovery

Cloudlist is a multi-cloud tool for getting Assets (Hostnames, IP Addresses) from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a centralized list of assets across multiple clouds with very little configuration efforts.

Festures

• Easily list Cloud assets with multiple configurations.
• Multiple cloud providers support.
• Highly extensible making adding new providers a breeze.
• STDOUT support to work with other tools in pipelines.

Links:

• https://github.com/projectdiscovery/cloudlist
• https://hakin9.org/cloudlist-a-tool-for-listing-assets-from-multiple-cloud-providers/
  

Assess Cloud Misconfiguration with CheckOV.io

Checkov is a static code analysis tool for infrastructure-as-code.

It scans cloud infrastructure provisioned using Terraform, Cloudformation, Kubernetes, Dockerfile and detects security and compliance misconfigurations using graph-based scanning.

Checkov is written in Python and provides a siple method to write and manage policies. It follows the CIS Foundations benchmarks where applicable.

Features

• Over 1000 built-in policies cover security and compliance best practices for AWS, Azure and Google Cloud.
• Scans Terraform, Terraform Plan, CloudFormation, Kubernetes, Dockerfile, Serverless framework and ARM template files.
• Supports Context-awareness policies based on in-memory graph-based scanning.
• Supports Python format for attribute policies and YAML format for both attribute and composite policies.
• Detects AWS credentials in EC2 Userdata, Lambda environment variables and Terraform providers.
• Identifies secrets using regular expressions, keywords, and entropy based detection.
• Evaluates Terraform Provider settings to regulate the creation, management, and updates of IaaS, PaaS or SaaS managed through Terraform.
• Policies support evaluation of variables to their optional default value.
• Supports in-line suppression of accepted risks or false-positives to reduce recurring scan failures. Also supports global skip from using CLI.
• Output currently available as CLI, CycloneDX, JSON, JUnit XML and github markdown and link to remediation guides.

Checkov supports developers using Terraform, Terraform plan, CloudFormation, Kubernetes, ARM Templates, Serverless, Helm, and AWS CDK.

Links:

• https://securityonline.info/checkov-prevent-cloud-misconfigurations-during-build-time-for-terraform-cloudformation-kubernetes/
• https://github.com/bridgecrewio/checkov

Enhancing Cloud Security Operations : Visibility

Visibility is a key element to identify and respond to cloud security incidents. This session explores how we can leverage native offerings to help solve the visibility problem.

In this webinar, Roger shares the following topics with us, and helps us to keep up with the ever-changing threat landscape.

• Cloud adoption
• Security concerns
• How do we solve the problems
• Native tools
• Gaps
• 3rd party tools
• Automation

Links:

• https://www.youtube.com/watch?v=rEP53j60QXQ
  

Defending Public Cloud for Enterprise Tricks and Tips!

 

The public cloud expansion is a reality and maintaining fences up is not easy. Come learn about AWS/Azure/GCP organization rules, policies and best practices to avoid potential threats that help to enforce good practices and avoid potential issues and misconfigurations. 

In this webcast, Moises will cover how to: 

• - Allow new accounts, subscriptions, or project to start with security practices in place 
• - Reduce the risk that shadow IT could grow without security policies and good practices 
• - Enforce security good practices even if users try to resist it 
• - Maintain cloud environments aligned with legal and privacy requirement

 Final Thoughts - Toolbox !

1. Prowler - github.com/toniblyx/prowler
2. Cloud Custodian -  cloudcustodian.io
3. CheckOV - checkov.io
4. CloudSploit - cloudsploit.com
5. rcentry - arcentry.com
6. Falco - falco.org
7. ScoutSuite - github.com/nccgroup/ScoutSuite

Final Thoughts - References!

1. CIS Benchmarks - cisecurity.org
2. Cloud Security Alliance - cloudsecurityalliance.org
3. OWASP - owasp.org
4. NIST - nist.gov
5. ENISA - www.enisa.europe.eu
6. Each cloud provider has well-architecture guide
   

Top 11 Open Source Cloud Security Tools

Top 11 Open Source Cloud Security Tools

• Wazuh Cloud
• Osquery
• GoAudit
• Grapl
• OSSEC
• Suricata
• Zeek/Bro
• Panther
• Kali Linux
• KeePass
• Metasploit Framework

 

Links:

• https://cybersecuritynews.com/cloud-security-tools/
  

An Easier Way to Multi cloud, Multi account Cloud Compliance (and Demo)

 

Compliance professionals understand the challenges of auditing modern cloud environments that span multiple accounts and multiple cloud providers.

Tools:

• OSQuery - https://osquery.io/
  
• CloudQuery - https://hub.cloudquery.io/
  

Start Your Own Pentest on Cloud and Container with Atomic Red Team

Atomic Red Team is a collection of small, highly portable detection tests mapped to MITRE ATT&CK®. This gives defenders a highly actionable way to immediately start testing their defenses against a broad spectrum of attacks.

MITRE ATT&CK™ offers the security community a common language to communicate about adversary tactics, techniques, and behaviors. In the articles and resources below, we offer guidance on how security teams can use the framework to expand detection coverage and increase visibility.

Links:

• https://redcanary.com/blog/art-cloud-containers/
• https://redcanary.com/atomic-red-team/ 
• https://redcanary.com/mitre-attack/
  
• https://github.com/redcanaryco/atomic-red-team/
• https://attack.mitre.org/resources/updates/
  

The Threat Detection with Cloud API Logs: A Case Study from Capital One

 

My notes:

• Methodologies for Cyber Threat Intelligence: [06:00]
  
• Blacklist - hashes, IP, ports, 
• Statistical Analysis
  
• Behavior Analysis - Mitre Att&ck (intention/tactics) [06:55]
  
• Case Study : Capital One Attack [08:58]
• T1595: Active scanning
  
• T1190: Exploit webap (SSRF) [13:25]  
• T1552: Access EC2 metadata service [14:14]
• T1526: Discover Token to access to all S3 bucket [15:20] 
• T1530: Data exfil from S3 cloud storage
• The Cloud API Service [18:50]
• CloudTrail - for threat hunting using API calls [20:00]  
• Azure Resource Provider Operations [30:00]
• Portal
• CLI: az privoder operation list
• Azure Activity Log [33:13]
• only provides Create, Update, Delete (no Read)
• Grouped by correlation ID
• Azure IMDSv1 Vs IMDSv2
  

Cloud Security Management Practices You Might Have Neglected

 

My notes:

1. Public cloud offers a lot of new capabilities. [10:00]
   
2. Establish a unified security strategy.

• Pace of change is daunting to everyone. [11:00]
  
• Team working in isolation will lead to mis-alignment. [13:00]
• Requires sponsorship from senior leadership. [19:00]
  
• Encourage shared goals. [22:00]
  
• Focus on the end goal, less about which technology. [22:35]
  

1. Transitions in security roles:

• Responsibilities shifting and Focus shifting [24:00] 
  
• CISO Guide to cloud security transformation [27:25]
  
• Training [31:00]
  
• planning roles, coordination roles, key technical roles. [32:00]
  

1. Forget and Re-learn Security Best Practices:

• Existing on-Prem security model is dangerous for Clouds. [34:30]
• Start from security objectives [38:40]
  
• Be flexible and adopt the cloud native ways [40:00]
  
• Keep scalability and automation in mind [42:00]
  

T0pCyber / Hawk

Hawk is an open-source, PowerShell-driven, community-developed tool network defenders can use to quickly and easily gather data from O365 and Azure for security investigations. Incident responders and network defenders can investigate specific user principals or the entire tenant. Data it provides include IP addresses and sign-in data. Additionally, Hawk can track IP usage for concurrent login situations.

Hawk users can review login details for administrator accounts and take the following steps.

1. Investigate high-value administrative accounts to detect anomalous.
2. Enable PowerShell logging.
3. Look for users with unusual sign-in locations, dates, and times.
4. Check permissions of service principals and applications in M365/Azure AD.
5. Detect the frequency of resource access from unusual places.
6. Review mailbox rules and recent mailbox rule changes.
   

Links:

• https://github.com/T0pCyber/hawk 
• https://myseq.blogspot.com/2021/03/crowdstrike-crt.html
• https://myseq.blogspot.com/2021/03/cisagov-sparrow.html
• Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
• Detecting Abuse of Authentication Mechanisms 
  

CrowdStrike / CRT

CrowdStrike's Azure Reporting Tool can help analyzing Microsoft Azure AD and M365 environment in their Azure AD tenant and service configuration. 

This tool has minor overlap with Sparrow; it shows unique items, but it does not cover the same areas. CISA is highlighting this tool because it is one of the only free, open-source tools available to investigate this activity and could be used to complement Sparrow.

Links:

• https://github.com/CrowdStrike/CRT
  

cisagov / Sparrow

Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment.

The tool is intended for use by incident responders, and focuses on the narrow scope of user and application activity endemic to identity and authentication based attacks seen recently in multiple sectors.

Sparrow.ps1 will check and install the required PowerShell modules on the analysis machine, check the unified audit log in Azure/M365 for certain indicators of compromise (IoC's), list Azure AD domains, and check Azure service principals and their Microsoft Graph API permissions to identify potential malicious activity. The tool then outputs the data into multiple CSV files that are located in the user's default home directory in a folder called 'ExportDir' (ie: Desktop/ExportDir).

Links:

• https://github.com/cisagov/Sparrow
  

Webinar: The Power of Logs

Just attended the webinar on Microsoft Security Hour, by Paula Januszkiewicz. This is the second webinar from her (this year), and this is about "The Power of Logs: Efficient Data Extraction Using Microsoft Solutions".

The webinar includes an excellent demo Azure Sentinel, and showing how she setup everything from scratch till creating the connectors and setting up the alert monitoring, within 20 minutes.

 

Moving Operations to the Cloud

Watched a video on YouTube, about "Moving operations to the Cloud", at
https://www.youtube.com/watch?v=wzAymfsUFBk by Ryan (SANS instructor)

 

This talk is about some of the nuances that cloud brings to any organization when transitioning from on-premise to an IaaS cloud environment. It provides better preparation to defend cloud-hosted, applications and services. 

Ryan at ryananicholson · GitHub