The Hidden Access Paths to Smaugs Cavern
summary
History of misconfigurations includes exception trackers receiving production secrets, Redis deployed without TLS, and developers pushing prod keys into repos; admin dashboards routinely include login as user and 60% of teams still impersonate accounts. One attacker edits scheduled jobs and siphons 250k salami attack over time. Detection work uses behavioral analytics, graph visualizations of IAM chains and started ML on cloudtrail 17,000 event types. Remediations shown: enforce hardware MFA, use SCPs and IAM Identity Center, automate invariants and build support tooling that never grants direct user-account access.
AI-written summary · about
chapters (5)
- 0:00Introduction and welcome
- 2:11Early career and hidden paths
- 6:26Understanding user behavior
- 11:42Remediation strategies
- 15:54Q&A session
related talks
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
22mDevSecOps - The Story of 3 Security Breaches
45mProtecting you from you: Misconfiguration-caused breaches
36mCloud Hacking Scenarios
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
37mLocking Down the Security of IAM