Red flags and attention points in cloud security audit, watch the security gates.

AI, Cloud & Modern Workplace
Conference 2024
15, 16 & 17 February , Online Conference
https://aicmwc.azurewebsites.net

AI, Cloud & Modern
Workplace Conference 2024
Red flags and attention points in cloud
security audit
Watch the security gates
15 February 2024 , 21:00 P.M. (GMT+2)
Peter GEELEN
MVP Security (Identity & Access)
https://www.linkedin.com/in/pgeelen/

AI, Cloud & Modern Workplace Conference 2024
Important to know: Security = PPT
• PPT
• People
• Process
• Technology

Security across the company
• Strategic
• Tactical
• Operational
STRATEGIC (CxO)
TACTICAL (Dept.)
OPERATIONAL

Management team tasks
• Accountability
• Planning
• Resources
• Operations
• Performance
• Continuous improvement
Act Plan
Do
Check
Act Plan
Do
Check
Security
Improvement
Time

Security controls
• Asset management
• Identity & access management
• System & network security
• Secure configuration & baseline
• Physical security
• Threat and vulnerability
management
• Application security
• Policies & procedures
• Documentation
• HR security
• Supplier Management
• Incident management
• Business continuity
• Disaster recovery

Security is a process, continuously changing
1
2
3
In
Few tasks
simple
Change
Important volume of tasks
Dependent tasks
Balance from one to another
Out
Lots of tasks
Lengthy
Complex
Legal impact
Possible reactivation
Uniqueness Conflicts

How are you doing?

How is your customer or supplier doing?

Monitoring or Audit: what’s the difference ?
Monitoring
• Performance check
• Continuous (or high frequency)
• By Owner
Audit
• Compliance check
• Regular intervals (lower frequency)
• Independent from owner

Audit types
• 1st party (internal audit)
• 2nd party
• Customer > supplier
• Supplier > customer
• 3rd party
• external

Audit types : internal audit
• Self-validation (Auditing within company)
• No publication to external parties
• No certificate

Audit types : 2nd party audit (mutual)
• Commercial interest first
• Contractual dependence
• Due diligence
• Mutual interest
• Customer checking (potential) supplier
• Supplier checking (potential) customer, eg before onboarding
• Delegation / verification of compliance
• Verification if delegated tasks are done correctly

Audit types : 3rd party audit (external)
• Independence between parties
• Auditor vs customer
• No combination of consulting & audit allowed
• Segregation of duties
• Official certificate
• Published
• Available to external parties

Audit main principles
• Snapshot of situation
• Quick estimation of situation
• Risk based
• Solution based, continuous improvement
Some hands-on experience to stay out of trouble
… detecting the red flags

1. First login with god mode
• First login
• First administrator
• Full power
• God mode
Solution
- Create special admin account
- No mail, enable MFA

2. User ID and password
• Typically personal account
• User ID… and just password (an mail address)
Solution
• MFA
• Hardware tokens
• Passkeys (MFA next gen)

3. Default groups
• Azure Groups
• Large volume of Azure and M365 Roles
Solution
• Avoid the use of default groups
• Task based access, granular control
• Only use default groups when no other option left

4. Ad-hoc (eh..no) Identity Management
• Manual management
• No process
• User duplication from existing users
Solution
• Setup basic IDM (identity mgmt)
• Setup IAM (identity and access mgmt)
1
2
3
In
Start of identity
Hire,
onboarding,
provisioning,
create,
Begin, ...
Change of identity, move,
promotion, update, maintenance,
operations, ...
Out
End-of-life
Fire,
termination,
End-of-contract,
deprovisioning,
Revocation,
delete, ...

5. No process management
• Manual management
• No process owner
• No process
• No idea how data flows
• No idea on changes
Solution
• Use basic process definitions
• Check ISO9001

6. All-in one account
• User account = admin account
• Mail enabled
• Used for office and admin tasks
Solution
• Account separation
• Segregation of duties
• Separate logins for users and administrators

7. All-in one desktop
• Login account = local admin account
• Full access
• …
Solution
• Daily operations as user
• Admin for specific access

8. RDP remote access
• RDP to Azure
• …
Solution
• Bastion host

9. One network
• One network
• Direct connections to Azure
• No segmentation (neither in Azure as physical)
Solution
• Segmentation
• Firewalls on every host and every network

9. Onetime configuration
• One configuration fixed at first configuration
• But once set, never reset …
• No review
• No IDM cycle
Solution: check...
• Everytime on new configuration
• During changes
• Check regularly (put it on your agenda)
• Use IDM (lifecycle)

AI, Cloud & Modern
Presentation Title
18 February , 9 P.M. (GMT+2)
References
• Microsoft
• Azure compliance: ISO27001
• Azure compliance: ISO27017 / ISO 27018
• Learn Microsoft Azure audit and logging fundamentals
• Azure security logging and auditing
• Azure security management and monitoring overview

AI, Cloud & Modern
Presentation Title
References
• Azure hardening
• Azure security best practices and patterns

AI, Cloud & Modern
Presentation Title
References
• ISO standards
• ISO 27001: ISMS (information security management system)
• ISO 27002: ISMS guidance
• ISO 27017: cloud security
• ISO 27018: PII in cloud (data protection in cloud
• Cloud security basics (CCSK by CSA)
• https://cloudsecurityalliance.org/
• Cloud controls matrix

AI, Cloud & Modern
Presentation Title
More of this…
• On my blog
• Identity Underground
• https://identityunderground.wordpress.com/

Thank You !!!
AI, Cloud & Modern Workplace
Conference 2024

Red flags and attention points in cloud security audit, watch the security gates.

Recommandé

Recommandé

Contenu connexe

Similaire à Red flags and attention points in cloud security audit, watch the security gates.

Similaire à Red flags and attention points in cloud security audit, watch the security gates. (20)

Plus de Peter GEELEN ✔

Plus de Peter GEELEN ✔ (7)

Dernier

Dernier (20)

Red flags and attention points in cloud security audit, watch the security gates.