Cyberstudy
PDF p.230 In progress

Cloud-based Application Attacks

Open PDF at p.230 22 flashcards

Summary

PDF p.230

Cloud-based application attacks target applications hosted on cloud platforms, exploiting vulnerabilities in the applications or cloud infrastructure. These attacks often involve misconfigurations, weak authentication, insufficient network segmentation, or poorly implemented access controls.

In plain words

Supplementary — not from your PDF

Cloud apps are attacked through misconfigurations, weak authentication, poor segmentation and access control, and gaps caused by confusion over shared responsibility. Cloud-specific threats include side-channel attacks between tenants on shared hardware and cryptojacking (stealing compute to mine cryptocurrency). Attackers also host phishing and malware on cloud services. A cloud access security broker (CASB) mediates cloud access through SSO, scanning, monitoring and data exfiltration controls, deployed as a forward proxy, reverse proxy or API.

Detailed explanation

PDF p.230
  • Characteristics
    • Exploitation: Misconfigurations, weak authentication, insufficient network segmentation, poor access controls.
    • Shared Responsibility Model: Can lead to confusion about security responsibilities, creating gaps for attackers.
    • Accessibility and Scalability: Cloud's nature makes it an attractive target for attackers.
  • Unique Cloud Attacks
    • Side-Channel Attacks: Attackers with instances on the same physical server extract information via shared resources.
    • Cryptojacking: Using cloud processing power to mine cryptocurrency without consent, increasing costs and degrading performance.
  • Cloud as an Attack Platform
    • Phishing and Malware Distribution: Setting up fraudulent websites or hosting malicious files on cloud services.
    • Exploitation: Tricking users into revealing sensitive information or distributing malware via phishing emails.
  • Cloud Access Security Brokers (CASB)
    • Definition: Enterprise management software mediating access to cloud services.
    • Functions
      • Single Sign-On Authentication: Enforce access controls and authorizations.
      • Malware Scanning: Detect rogue or noncompliant device access.
      • Monitoring and Auditing: Track user and resource activity.
      • Data Exfiltration Mitigation: Prevent unauthorized cloud service access.
    • Implementation Methods
      • Forward Proxy: Positioned at the client network edge, forwarding traffic to the cloud if compliant.
      • Reverse Proxy: Positioned at the cloud network edge, directing traffic to cloud services if compliant.
      • API: Brokers connections between cloud service and consumer, communicating changes like disabled accounts or revoked authorizations.

Important terms

taken from the text above
Exploitation
Misconfigurations, weak authentication, insufficient network segmentation, poor access controls.
Shared Responsibility Model
Can lead to confusion about security responsibilities, creating gaps for attackers.
Accessibility and Scalability
Cloud's nature makes it an attractive target for attackers.
Side-Channel Attacks
Attackers with instances on the same physical server extract information via shared resources.
Cryptojacking
Using cloud processing power to mine cryptocurrency without consent, increasing costs and degrading performance.
Phishing and Malware Distribution
Setting up fraudulent websites or hosting malicious files on cloud services.
Cloud Access Security Brokers (CASB)
Enterprise management software mediating access to cloud services.
Single Sign-On Authentication
Enforce access controls and authorizations.
Malware Scanning
Detect rogue or noncompliant device access.
Monitoring and Auditing
Track user and resource activity.
Data Exfiltration Mitigation
Prevent unauthorized cloud service access.
Forward Proxy
Positioned at the client network edge, forwarding traffic to the cloud if compliant.
Reverse Proxy
Positioned at the cloud network edge, directing traffic to cloud services if compliant.
API
Brokers connections between cloud service and consumer, communicating changes like disabled accounts or revoked authorizations.
CASB Cloud Access Security Brokers

Examples & real-world scenarios

Supplementary — not from your PDF
  • An unexpected spike in cloud compute bills from cryptojacking.
  • A CASB blocking uploads of sensitive files to personal cloud storage.
  • A CASB API integration revoking access when an account is disabled.

Scenario

A company's cloud bill triples overnight and CPU usage is maxed on instances nobody launched. Leaked access keys used for cryptojacking are the likely cause. Rotate the keys, remove the instances, and enforce MFA and least privilege.

Common mistakes

Supplementary — not from your PDF
  • Assuming the cloud provider will notice and stop misuse of your account.
  • Forgetting that a CASB can work as a forward proxy, reverse proxy or API.

Practical skills

Supplementary — not from your PDF
  • List warning signs of cloud account misuse.
  • Choose a CASB deployment mode.

What I should remember

Key Points PDF p.230
  • Characteristics
    • Exploitation: Misconfigurations, weak authentication.
    • Shared Responsibility: Security gaps due to confusion.
    • Accessibility: Attractive target.
  • Unique Cloud Attacks
    • Side-Channel: Extract information via shared resources.
    • Cryptojacking: Unauthorized cryptocurrency mining.
  • Cloud as an Attack Platform
    • Phishing/Malware: Fraudulent websites, malicious files.
    • Exploitation: Sensitive information, malware distribution.
  • Cloud Access Security Brokers (CASB)
    • Definition: Mediates cloud service access.
    • Functions: Authentication, malware scanning, monitoring, data exfiltration prevention.
    • Implementation: Forward proxy, reverse proxy, API.