Top Cloud Native Attacks on software and data

Knowing what top cloud attacks are and how they can be prevented and mitigated is critical to keeping your organization as safe as possible from risks. These refer to a class of cyberattacks that target cloud computing environments such as public, private, or hybrid cloud infrastructure.

The following sub-sections describe the common vulnerabilities relevant to the authentication of users, software, and data systems running on the cloud.

User Identity Federation

One of the biggest threats to AWS accounts is the reuse of passwords by users with multiple accounts. This problem is solved with the use of identity federation. Users tend to find remembering various complicated passwords difficult. As a result, many users reuse the same passwords across multiple accounts. If one account gets compromised, even if it wasn’t the Cloud Service Provider’s account, it gives an opportunity to the attacker to gain entry to another...

DDoS Protection

Distributed denial of Service (DDoS) attacks are widespread and, if successful, can have a detrimental impact on an organization’s service operation. Depending on the scale of the DDoS attack, it can render an entire website unavailable, and for retail e-commerce businesses, this could cause them significant losses in sales.

Understanding DDoS and its attack patterns

To begin, the initiator of a DDoS attack will focus on a specific target such as a single host, network, or service to compromise. This target will likely be a vital component of an organization’s infrastructure. During an attack, an attempt will be made to severely disrupt the performance of the target using a massive number of inbound requests from several different distributed sources within the same period.

This creates the following two problems:

• The additional traffic load floods the target and prevents authentic and legitimate inbound requests from reaching that target...

Strengthening the security posture of your AWS account

Having explored the different types of attacks you may be subject to, you might be wondering how you can effectively protect your organization against all the threats it will face. This section deals with the steps you can take for the same.

When running a Cloud Security Posture Assessment (CPSA) against your account(s), you will need to create a role that will give read-only permissions to the service or tool performing the assessment. The assessment thoroughly reviews an organization’s cloud security policies, processes, and controls. It can also include an examination of the technical infrastructure that supports the organization’s cloud environment. The assessor can uncover potential weaknesses that an attacker would exploit by reviewing the account’s access controls, conducting vulnerability assessments, and analyzing security logs.

The following is a list of some of the vulnerabilities that are...

Summary

In this chapter, you learned about some of the most prevalent attacks security engineers face. This knowledge of common attacks puts the need for security services into perspective. It also allows you to have an understanding of the various services you will need as you go through the rest of this book with a crucial purpose. That purpose is to not only protect your cloud assets and data but to also be knowledgeable about the very common, specific types of attacks that they may face

You also explored one of the most prevalent attacks, DDoS, in depth, including how these attacks occur and which AWS services (namely, AWS WAF and AWS Shield / Shield Advanced, among others) help mitigate them.

The next chapter will detail sections dedicated to the AWS Security Specialty Certification domains, specifically Domain 1: Incident Response. It will begin with a focus on Incident Response and how it is handled in the context of an AWS account (or multiple accounts).

Further Reading

For additional information on the AWS shared responsibility model and an underlying foundation to AWS security, please look at the following resources:

• AWS Startup Security Baseline (AWS SSB):

  https://docs.aws.amazon.com/prescriptive-guidance/latest/aws-startup-security-baseline/welcome.html

• AWS Foundational Security Best Practices (FSBP) standard:

  https://docs.aws.amazon.com/securityhub/latest/userguide/fsbp-standard.html

• AWS Managed Rules group list for AWS WAF

  https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html

• Security Automations for AWS WAF

  https://aws.amazon.com/solutions/implementations/security-automations-for-aws-waf/

• OWASP Cloud-Native Application Security Top 10

  https://owasp.org/www-project-cloud-native-application-security-top-10/

• What is a DDoS Attack?

  https://owasp.org/www-project-cloud-native-application-security-top-10/

• Disaster Recovery of Workloads on AWS: Recovery in the Cloud (Whitepaper...

Strengthening the Security Posture of Your AWS Account

Having explored the different types of attacks you may be subject to, you might be wondering how you can effectively protect your organization against all the threats it will face. This section deals with the steps you can take for the same.

When running a Cloud Security Posture Assessment (CPSA) against your account(s), you will need to create a role that will give read-only permissions to the service or tool performing the assessment. The assessment thoroughly reviews an organization’s cloud security policies, processes, and controls. It can also include an examination of the technical infrastructure that supports the organization’s cloud environment. The assessor can uncover potential weaknesses that an attacker would exploit by reviewing the account’s access controls, conducting vulnerability assessments, and analyzing security logs.

The following is a list of some of the vulnerabilities that are...

Summary

In this chapter, you learned about some of the most prevalent attacks that security engineers face. This knowledge of common attacks puts the need for security services into perspective. It also gives you an understanding of the various services you will need as you go through the rest of this book with a crucial purpose. That purpose is to not only protect your cloud assets and data but to also gain knowledge about the very common, specific types of attacks that they may face.

You also explored one of the most prevalent attacks, DDoS, in depth, including how these attacks occur and which AWS services (namely, AWS WAF and AWS Shield/Shield Advanced, among others) help mitigate them.

The next chapter will detail sections dedicated to the AWS Certified Security Specialty domains, specifically Domain 1: Incident Response. It will begin with a focus on incident response and how it is handled in the context of an AWS account (or multiple accounts).

Further Reading

For additional information on the AWS shared responsibility model and for a better understanding of AWS security, refer to the following resources:

• AWS Startup Security Baseline (AWS SSB): https://packt.link/TEj5U
• AWS Foundational Security Best Practices (FSBP) standard: https://packt.link/PUdKl
• AWS Managed Rules group list for AWS WAF: https://packt.link/3v6om
• Security Automations for AWS WAF: https://packt.link/g8xlD
• OWASP Cloud-Native Application Security Top 10: https://packt.link/2Hz5K
• What is a DDoS Attack? https://packt.link/2Hz5K
• Disaster Recovery of Workloads on AWS: Recovery in the Cloud (whitepaper): https://packt.link/V5tJO

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH03.

   Alternatively, you can scan the following QR code (Figure 3.6):

Figure 3.6: QR code that opens Chapter Review Questions...