Multi-Cloud Anomaly Detection: Finding Threats Among Us in the Big 3 Clouds
summary
Shows how to detect cloud breaches by using native audit logs across AWS, Azure and GCP: enable VPC/VNet flow logs and API audit logs, persist them (recommend one year), and query with CloudWatch/CloudTrail, Azure Monitor/KQL, or Google Cloud Logging. Live demos find unusual outbound traffic on port 9999 DNS exfil (base32 -> MAC addresses), reveal GCP’s lack of blocked-ingress visibility without firewall logging, and spot exfil or key abuse with alarms such as 80 decrypts in 120s alarm. Also covers sampling, aggregation delays, and Terraform setup.
AI-written summary · about
chapters (5)
- 0:00Start
- 2:33Third-party IDS and DLP tools are costly What tools does your cloud provider offer as a service?
- 3:19Learn how to track cloud service activity in AWS, Azure, and GCP Explore each provider's network flow logging capabilities • Demonstrate two attacks that generate anomalous logs • Understand how these data points can feed into alerting capabilities to empower Incident Response teams • Compare and contrast each cloud's relevant services
- 9:58CIS Benchmark 6.4 Network Security Group flow logs should be enabled, and the retention period is set to greater than or equal to 90 days. 1. Enable the flow logs option in the Network Security Group 2. Create a storage account for flow log data 3 Configure a 365-day log retention period (90 minimum)
- 15:53Targets the hardware, firmware, packages and libraries apps depend on • Becoming more popular as custom code is less needed • Many different repositories for different ecosystems
related talks
48mCatch Me if You Can: Hunting Cloud Exfiltration Using Anomaly Detection
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
20mFantastic AWS Attacks and Where to Find Them
50mHunting Supply Chain Threats Using Anomaly Detection
28mPatterns for scalable security detections on AWS
31mCloud Threat Landscape - 2021
45mProtecting you from you: Misconfiguration-caused breaches
57mCloud’s Dirty Little Secret: It Was Misconfigs All Along