Breaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
summary
A leaked Terraform state file in a private GitHub repo exposes an IAM user's access keys that allow console login, then use of SSM session manager to access an EC2 instance, discovery of a ransomware demo S3 bucket and a public EBS snapshot; CloudTrail is off so forensic visibility is limited. Environment spans ~300 AWS accounts and ~100K identities, showing CSPMs surface too many undifferentiated alerts. Practical fixes: threat model cloud identity/resource/network, enforce a Data Perimeter (AWS Organization SCP) and run cloud-specific incident‑response readiness.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 13:54Terraform state breach walkthrough
- 20:00Three major cloud breaches analyzed
- 25:37Threat modeling cloud apps
- 32:04Data Perimeter in cloud security
- 39:30Incident response readiness
- 43:28CSPM limitations and future
- 46:16Q&A
related talks
39mPerils of the cloud
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
48mNine Cloud Security Reasons for Resting Breach Face
45mProtecting you from you: Misconfiguration-caused breaches
36mCloud Hacking Scenarios
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had
16mLessons from the SOC: Analyzing and remediating cloud attack paths
26mCloud Security Lessons