Who Gave the Agent Admin Rights?! Securing Cloud & AI Machine Identities
summary
Shows how a misconfigured WAF plus an over‑privileged IAM role lets an attacker grab temporary creds from 169.254.169.254 IMDS access and siphon data from 700 S3 buckets (Capital One 2019 example, four months undetected). Demonstrates a testbed of 29 attack scenarios, shipped detection: Wazuh + auditd/FIM rules, 100 detection rules (92 Sigma portable), SPIFFE/SPIRE selector‑spoofing detections, and bi‑directional correlation that surfaces level‑15 multi‑stage NHI compromises.
AI-written summary · about
chapters (23)
- 0:00Machine identity security intro
- 1:07Capital One breach case study
- 6:52Non-human identities and risks
- 9:21Non-human identity attack chain
- 9:42AWS IMDS vulnerabilities deep dive
- 11:08IMDS credential theft demo
- 12:55Detecting IMDS abuse
- 13:17AI agent risks and threats
- 14:45OWASP LLM risks overview
- 15:51AI attack detection in Wazuh demo
- 20:04SPIFFE/SPIRE workload security
- 22:34SPIFFE attack surface rules
- 23:44SPIFFE spoofing attack demo
- 28:30AI system compliance requirements
- 30:58Traditional rules vs ML detection
- 33:09Detection architecture overview
- 37:41Correlation rules for attacks
- 41:56Real-time IMDS attack demo
- 44:36Immediate machine identity actions
- 45:44Long-term NHAI security strategies
- 47:34Open-source detection library
- 48:17Three-week deployment plan
- 49:02Key takeaways summary
related talks
44mCloud Metadata Abuse
22mThe Hidden Access Paths to Smaugs Cavern
37mLocking Down the Security of IAM
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
40mWeak Links in Cloud IAM - Never Trust. Always Verify!
30mNavigating the New AI Security Landscape
36mCloud Hacking Scenarios
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had