Cloud Security in the Face of COVID-19: Problems and Solutions
June 18, 2020

Mark Moore
Threat Stack

The start of 2020 was an extremely turbulent time as the world dealt with the spread of COVID-19 and businesses globally shifted to a fully remote work environment on an extremely abbreviated timeline. This situation has had a downstream effect on security teams that were suddenly and unexpectedly forced to deal with dramatic changes to their environment.

The Threat Stack Security Operations Center (SOC) recently pulled together research into how businesses are managing their cloud infrastructure since the COVID-19 quarantine began and identified some interesting trends that stood out to me.

AWS Systems Manager Usage Growing

AWS continues to develop its Systems Manager service (SSM) as a powerful automation multi-tool, and users are noticing. SSM usage in Q1 2020 saw a major uptick but there are a few best practices in managing the tool:

Mitigate Automation Risk by Tuning Permissions and Access Controls – SSM Session Manager and SSM Run Command are two features whose activity manifests itself differently in the underlying event metadata. SSM Run Command lets users automate a range of predefined configuration tasks across EC2 instances and currently offers 36 Command Documents that are prebuilt to speed common admin tasks like configuring Docker or updating EC2 settings. Because they are for system admin use, they run with admin-level permissions. SSM gets a lot of permissions by necessity as an automation tool. By default, it creates a user with root privileges: ssm-user on your EC2 hosts. Disabling this admin user might be an option, depending on your use case.

Get granular with Identity Access Management (IAM) – These features can create problems for security teams if IAM permissions are not finely scoped down to the individual components of SSM. There are several IAM managed policies specific to SSM, and the documentation provides further examples for writing your own identity-based policies.

Security Teams Showing Lax Kubernetes Security

While growth in Kubernetes usage isn't new, security teams are increasingly losing sight of the security risks that are present when using microservices. For instance, load balancers serving as Amazon Elastic Kubernetes Service (EKS) Ingress Controls default security settings are not adequate for all businesses. Rather than relying on AWS to protect critical business data, including cleaning up permissions every 90 days, organizations should proactively remove them once the load balancer is no longer used.

It should be noted that EKS clusters also use the Amazon VPC CNI plugin for Kubernetes, allowing it to represent pods on the VPC itself. This isn't enough to support Kubernetes network policies without additional manual integration of Calico. Moreover, because of how the CNI maps down to the host's ENIs, the CNI can only support one security group per node. This can potentially create problems when EKS schedules unrelated pods on the same node.

Immediate, Widescale Multi-Factor Authentication

Faced with the prospect of their entire workforce now accessing applications and sensitive business data remotely, many organizations decided to either rollout or expand multi-factor authentication (MFA). MFA adoption is a net-positive for businesses and provides dividends even after workers return to the office.

However, the speed with which many organizations were forced to roll out MFA led to a large number of users who were not provisioned properly or employees having either too much or too little access to corporate information. Either scenario isn't ideal as productivity is being inhibited and businesses can be exposed to unnecessary risk.

Changes in Behavior Complicate Security Investigations

As remote workers are signing on from new IPs, from different locations, or outside typical working hours, security teams are forced to confirm that what used to be normal behavior is still expected. It's important for IT and Security leaders to understand their cloud environment by baselining what is normal expected behavior and what could be deemed suspicious.

The beginning of 2020 was a time of rapid and unexpected change for security teams globally that demanded flexibility and creative problem solving. More of the same can be expected moving forward and businesses begin re-opening their offices. Security teams should be focusing on ensuring that their teams are set up for success and are able to monitor their cloud environment, identify suspicious behavior, and take meaningful action to remediate threats and reduce risk.

Mark Moore is Senior Software Security Engineer at Threat Stack
Share this

Industry News

December 06, 2022

The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, announced the graduation of Argo, which will join other graduated projects such as Kubernetes, Prometheus, and Envoy.

December 06, 2022

Wib announced API PenTesting-as-a-Service (PTaaS) designed to help organizations proactively cover the latest PCI-DSS 4.0 mandates for testing application security, APIs, and vulnerabilities in Business Logic.

December 05, 2022

Harness announced Harness Cluster Orchestrator to allow customers to optimize their Kubernetes cloud workload costs and realize up to 90% cloud cost savings with Amazon Elastic Compute Cloud (Amazon EC2) Spot instances from Amazon Web Services (AWS).

December 01, 2022

Salesforce introduced a new Automation Everywhere Bundle to accelerate end-to-end workflow orchestration, automate across any system, and embed data and AI-driven workflows anywhere.

December 01, 2022

Weaveworks announced that Flux, the original GitOps project, has graduated in the Cloud Native Computing Foundation (CNCF®).

December 01, 2022

Tigera announced enhancements to its cluster mesh capabilities for managing multi-cluster environments with Calico.

December 01, 2022

CloudBees achieved the Amazon Web Service (AWS) Service Ready Program for Amazon Elastic Compute Cloud (Amazon EC2) Spot Instances.

November 30, 2022

GitLab announced the limited availability of GitLab Dedicated, a new way to use GitLab - as a single-tenant software as a service (SaaS) solution.

November 30, 2022

Red Hat announced an expansion of its open solutions publicly available in AWS Marketplace.

November 30, 2022

Sisense announced the availability of the Sisense CI/CD Git integration module.

November 29, 2022

Codenotary announced TrueSBOM for Serverless, a self-updating Software Bill of Materials (SBOM) for applications running on AWS Lamda, Google Cloud Functions and Microsoft Azure Functions that is made possible by simply adding one line to the application source code.

November 29, 2022

Code Intelligence announced its open-source Command-Line Interface (CLI) tool, CI Fuzz CLI, now allows Java developers to easily incorporate fuzz testing into their existing JUnit setup in order to find functional bugs and security vulnerabilities at scale.

November 29, 2022

Parasoft announced the 2022.2 release of Parasoft C/C++test with support for MISRA C:2012 Amendment 3 and a draft version of MISRA C++ 202x.

November 28, 2022

Kasm Technologies announced the release of Kasm Workspaces v1.12, providing major enhancements to its portfolio of digital workspaces delivering Desktop as a Service (DaaS), Virtualized Desktop Infrastructure (VDI), Remote Browser Isolation (RBI), Open-Source Intelligence Collection (OSINT), Training/Sandboxes, and Containerized Application Streaming (CAS).

November 28, 2022

Cloud4C has achieved Amazon Web Services (AWS) DevOps Competency status.