4 ms·
The root account credentials should be used to create a privileged IAM user and then physically locked away in a box after setting up a hardware MFA device (plu
by ak217 6y ago
The root account credentials should be used to create a privileged IAM user and then physically locked away in a box after setting up a hardware MFA device (plus a backup MFA) for the root account: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practi...
The privileged IAM user should then be used to administer other IAM users and roles. All IAM users should be required to have hardware security keys like Yubikey.
- liaukovv 6y agoBut how fast a determined attacker will be able to utilize acquired physical key? Is something like kidnapping in the threat model for companies like ubiquiti?
- ak217 6y agoThose kinds of fanciful things are not commonly in threat models because they don't happen. The threat models address things that are likely to happen, which are all variations of someone's device getting compromised.
- mywittyname 6y ago> Is something like kidnapping in the threat model for companies like ubiquiti? I doubt it. That's going to raise some blinking red flags on the radar of organizations you don't want to be on the radar of. Not just three-letter federal organizations, but three-letter news organizations too. The current situation is Yet Another Security Breach that will be forgotten about in 15 minutes. But a kidnapping is interesting! People will be making documentaries and shit about that. It's so much easier and cheaper to bribe people than it is to kidnap them.
- deleted 6y ago[deleted]
- the8472 6y ago> (plus a backup MFA) IAM doesn't even let you register more than 1 MFA device.
- ak217 6y agoIf I were a CISO solving this problem today, I would just use TOTP instead of U2F, and store the secret in two places. Longer term I expect AWS will add this capability.
- ryan29 6y agoI have accounts for personal use and what I did was set up TOTP for the root account(s) and a U2F (YubiKey) device for the admin account(s). I use 2 YubiKeys; one primary, one spare. The YubiKey has limited TOTP space, but they're perfect for those types of high value accounts. You store the TOTP on both, so if you lose one you can use the root account to fix the admin account.
- sneak 6y agoAWS SSO does now, thankfully.