3 ms·
While I agree with the sentiment there, lapsus didn't get initial access via social engineering. They used social engineering to stay ahead of detection. My p
by cookiengineer 5y ago
While I agree with the sentiment there, lapsus didn't get initial access via social engineering.
They used social engineering to stay ahead of detection.
My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC.
And that is the security responsibility nobody wants to be part of. Neither AWS and neither the organization that rents the machine.
- sofixa 5y agoThere are VPC flow logs for all things in a VPC.
- bijoo 5y ago> My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC. It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services." Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoint-services-gwlbe.html https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
- milkshakes 5y agothis is dangerously incorrect