,
3 tweets,
1 min read
Read on Twitter
Let’s talk about security measures that didn’t seem to be in place, based on my reading of the CapitalOne case.
1) Lots of PII, SSNs, etc not individually encrypted or tokenized. At-rest encryption of these is necessary, but not sufficient.
1) Lots of PII, SSNs, etc not individually encrypted or tokenized. At-rest encryption of these is necessary, but not sufficient.
2) Use of IAM role creds from *outside* the cloud env was not detected.
3) Access of what appear to be logging S3 buckets, also from outside the cloud env, was not detected.
CloudTrail event monitoring is your friend and should be your #1 priority for AWS security.
3) Access of what appear to be logging S3 buckets, also from outside the cloud env, was not detected.
CloudTrail event monitoring is your friend and should be your #1 priority for AWS security.
4) AWS Macie would have identified massive amounts of PII and other sensitive info in the S3 buckets.
5) AWS GuardDuty would have alerted on some of this too (e.g. S3 access by Tor exit node).
Turn these on, send alerts to your security team *and* team that owns the AWS asset.
5) AWS GuardDuty would have alerted on some of this too (e.g. S3 access by Tor exit node).
Turn these on, send alerts to your security team *and* team that owns the AWS asset.
