5 ms·

None of the issues here are related to being cloud native. If you are completely on-prem, but your employees are remote the same social engineering attacks woul

None of the issues here are related to being cloud native. If you are completely on-prem, but your employees are remote the same social engineering attacks would work on your organization. The issue is with companies having absolutely garbage security practices.

oh_sigh 5y ago
I thought it was interesting that neither Facebook nor Google were listed
cookiengineer 5y ago
While I agree with the sentiment there, lapsus didn't get initial access via social engineering. They used social engineering to stay ahead of detection. My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC. And that is the security responsibility nobody wants to be part of. Neither AWS and neither the organization that rents the machine.
- sofixa 5y ago
  There are VPC flow logs for all things in a VPC.
- bijoo 5y ago
  > My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC. It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services." Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoint-services-gwlbe.html https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
- milkshakes 5y ago
  this is dangerously incorrect
choeger 5y ago
Yeah, no. In the ideal on premise setup you can shutdown remote access on the network level. You're not an admin? You cannot reach admin tools from your VPN. You can also always offer a personal two factor authentication for exemptions, introduce four-eyes policies, etc. Of course, this is complicated and a big part of the reason cloud is so successful is that the engineers capable of doing complicated stuff are hired by the cloud providers. My pet theory is that FAANG pay so high salaries to prevent competition and home-grown solutions as much as possible by attracting the top x% of the talent pool.
- markus_zhang 5y ago
  How do you learn such things, just curious. It seems to be combination of sys admin, security and something else.
  - choeger 5y ago
    I think by starting small. Setup a raspberry pi for home automation, etc. Maybe connect a NAS or so. Add your own dedicated server with domain name, etc. My hypothesis is that you learn much more effective by learning the basics because 99% of the shiny fancy cloud-scale tools deal with inconveniences that occur when you do basic stuff in a larger setting.

oh_sigh 5y ago

I thought it was interesting that neither Facebook nor Google were listed

cookiengineer 5y ago

While I agree with the sentiment there, lapsus didn't get initial access via social engineering. They used social engineering to stay ahead of detection. My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC. And that is the security responsibility nobody wants to be part of. Neither AWS and neither the organization that rents the machine.

sofixa 5y ago
There are VPC flow logs for all things in a VPC.
bijoo 5y ago
> My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC. It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services." Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoint-services-gwlbe.html https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
milkshakes 5y ago
this is dangerously incorrect

choeger 5y ago

Yeah, no. In the ideal on premise setup you can shutdown remote access on the network level. You're not an admin? You cannot reach admin tools from your VPN. You can also always offer a personal two factor authentication for exemptions, introduce four-eyes policies, etc. Of course, this is complicated and a big part of the reason cloud is so successful is that the engineers capable of doing complicated stuff are hired by the cloud providers. My pet theory is that FAANG pay so high salaries to prevent competition and home-grown solutions as much as possible by attracting the top x% of the talent pool.

markus_zhang 5y ago
How do you learn such things, just curious. It seems to be combination of sys admin, security and something else.
- choeger 5y ago
  I think by starting small. Setup a raspberry pi for home automation, etc. Maybe connect a NAS or so. Add your own dedicated server with domain name, etc. My hypothesis is that you learn much more effective by learning the basics because 99% of the shiny fancy cloud-scale tools deal with inconveniences that occur when you do basic stuff in a larger setting.