EP95 Cloud Security Talks Panel: Cloud Threats and Incidents

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday afternoon Pacific time, please do hit that subscribe button. Please rate our podcast on your podcasting app of choice if you think highly of the show. If you don't, uh, send us polite feedback, maybe offline. Don't give us a bad rating. You can follow the show and argue with us on Twitter as well, twitter.com/cloudsecpodcast. Anton, we've got a whole panel on the show today. That's pretty fun.

Yes. So this is actually a collaboration between Cloud Security Podcast, well, that means us, and the Cloud Security Talks, which is kind of a quarterly conference that Google Cloud runs. It's kind of a virtual conference. It was never on-prem because I think it was born during COVID times. So it was, you know, virtual native.

Can you say virtual native?

Yeah.

So the point is that it's a virtual conference. It's way bigger than a webcast or a podcast. And so this was recorded originally for the panel at the conference, and now we are doing a podcast on this, as it's very fun. You're going to hear some deep secrets about cloud incidents. Maybe not.

And listeners, you can check out all of the great content from that day event if you search for Google Cloud Security Talks 2022. We had some awesome people presenting content throughout the day. We had Botter, who will soon be an episode guest. We've got some of my other favorite folks from the organization. And there's some guy talking about using SCC to detect threats. Oh, that's me. I've even got a slot this time. So it'll be a fun day of good talks. But Anton, this talk that we're rebroadcasting on the podcast today in particular, I think is pretty interesting because we touch on one of the most interesting aspects of cloud security, which is its intersection with the rest of security.

Correct. Correct.

And it's, I mean, we have a cloud security podcast, so it sounds like we are motivating people to improve cloud security. But think about the environments where perhaps cloud security is done really well because it's a modern environment, because they practice some form of bimodal IT, modern teams, modern skills, modern tools.

Maybe some ASO.

Right, correct.

ASO principles for SOC, but their on-premise is run on legacy speed, the legacy mistakes, possibly legacy skills and very old tools. So in essence, one of the panelists hypothesized that perhaps in this case, cloud security doesn't matter. Because if your on-prem security is so bad that attackers can get the credentials, can get to trusted network endpoints, trusted other trusted things, then they can get to your cloud without breaking in. They would just go through the front door. So in that sense, does cloud security matter if you're a hybrid company and if your on-premise security is really bad? It's a great question to ponder. And even if your name isn't whatever—

I think this is a bit of a defeatist attitude though. Like, what you're suggesting— and I, I wasn't part of this recording, listeners, so I'm just gonna have to argue with, uh, the avatar of Anton here— what you're suggesting is that we should never suggest investments in securing things that are slightly more secure. We should only do the worst-off areas. And I think that's maybe gonna set organizations up to not be successful across the board.

Hmm.

So I, I don't want listeners to come away from this with a security defeatist attitude. But perhaps with that, let's turn things over to today's panelists.

Hello, and welcome to the security research panel today. The idea is to extract some of the useful lessons that organizations can use based on recent security research from Google, Mandiant, and Cybereason. Today on the panel, I have Alicia Cade from Google Cloud, Robert Wallace from Mandiant, and Ken Westin from Cybereason. Welcome to the panel. Now, I want to start from the first question. I want to look at cloud security incidents. So today, what do we know about how cloud environments are attacked and compromised? Is it still about the configuration mistakes? Is it about the new threats? Or is it about something that's more classic? Robert, what does your research say about this?

Hi, Anton. Thanks for having me. So, you know, from the Mandiant perspective, our research indicates that a lot of the attacks involving cloud environments, they still involve misconfiguration mistakes, but they also oftentimes involve password spraying or credential stuffing. That's one of the more common attack paths that we've noticed. And also, we're still seeing the traditional attacks on organizations in hybrid environments where they pivot from the traditional IT environment into the cloud.

And so when they pivot into the cloud, it's not because they want to be in the cloud, it's because they're just exploring what's there, right?

Typically, that's what we've seen. Correct.

Okay. Makes sense. Makes sense. And what do they do after they compromise? Of course, credential stuffing and other things are kind of Very 1990s. But what about the utilization? Is it still the boring crypto miners, or are they doing something exciting?

They're still boring crypto miners, but, you know, we do see some more interesting attacks taking place where attackers are able to enumerate applications and databases and grant privileges or permissions, if you will, that allows them to continue roaming through an environment searching for data. that they may want to exfiltrate or steal. And then obviously, we still see the coin miners as well looking to borrow that compute time.

It pays the bills, right? It may not be exciting for the researcher— well, especially for the APT researcher— but it pays the bills apparently for the attackers, right?

It can pay the bills for the attackers. But something to keep in mind, at least from a research and investigative perspective, is that something as mundane as a crypto miner could be a sign of something worse in the environment. So in the mTrends 2022 report, we describe an incident where a common exploit was used on a major vulnerability, and a crypto miner was deployed. But during the investigation, we identified APT threat actors who were also leveraging that exact same exploit to conduct their attacks. So I oftentimes say, where there's smoke, there's fire.

Perfect. Ken, what about your work at Cybereason? Anything exciting about cloud incidents or just in general trends in this area?

We've been doing a lot of research into cloud workload protection. And, you know, one area that I was, I was really interested in was container escapes. I think one challenge with a lot of the cloud applications is the orchestration, things like Kubernetes, which are incredibly complex to keep track of. I'm a big fan of Ian Coldwater and their work that they've done at Black Hat, talking about how easy it is to actually compromise some of those hosts, where if you identify a vulnerability in an application, for example, that may be deployed as part of an image, You can compromise a lot of those different systems. And then from there, be able to escalate your privileges. You can then escape the container and then get access to keys and things like that. And a lot of those actually occur because of, you know, a minor vulnerability in one application. And it's kind of one of those things where it's like a butterfly, you know, flaps its wings. When you start to look at the complexity of cloud architectures, it can be just that one little piece of vulnerability or, you know, one password that gets compromised that can lead to an entire application, entire infrastructure being compromised. So it's a big issue, I think, with businesses in particular, because a lot of times those applications, they're bread and butter. Those are critical business applications that when you actually bring those down, it's like bringing down a factory in a lot of respects because e-commerce stops, communication stops. And oftentimes too, there's also SLAs that are associated with that. So it's really interesting sort of seeing this evolution of security kind of getting dragged into the DevOps space. And we're seeing it more and more. And I used to always say that data had a security problem, but security now has a data problem.

Yeah, there is that. And it's kind of fascinating that we are talking about credential attacks from the 1980s and container escapes from the 2020s happening almost in the same place. I don't know. This whole past and the future theme is just tweaking me the wrong way because attackers are using some of the 40-year-old stuff and some of the new stuff at the same time, kind of in the same attack, right?

Yeah, what's old is new again.

Yeah, there is that. So how about we touch on everybody's favorite topic— not really— ransomware? Of course, funny enough, I've been kind of in love with the label created by Cybereason, I think, ransom ops, right? When ransomware isn't really malware in many cases. It's about the way to make money by ransoming something from, in this case, cloud user or an organization. Let's look at one of the popular threats today, ransomware. Based on your research, what can you say about its likely future? Is it cloud-focused? Is ransomware going to the cloud? Are they doing digital transformation to improve their ransom ops? Ken, what's your take on this?

The way I see it is ransomware is going to follow the data. We always talk about how data is the new oil. Well, there's a gold rush and it's your data. Ransomware operators have learned very quickly that, you know, they used to have commodity types of ransomware that, you know, your parents might download and get compromised. And that wasn't really very lucrative because they have to explain to people that maybe don't understand cryptocurrency how to get the money. And the payout was very small, maybe $1,000, maybe $5,000 if they were lucky. And they moved into targeting businesses because they realized that's where the business really cares about the value of their own data. It used to be that they would exfiltrate the data, sell the credit cards, things like that. That became much harder to make money at. And so they realized that the value of the data is actually more important to the business They're targeting, and it's becoming increasingly sophisticated. It's now, as I mentioned, it is truly a gold rush where we even have a situation where you have people selling pickaxes in a gold rush where you actually have sort of an underground sort of black mirror economy. And some of their software development lifecycle and how they operate is sort of a black mirror of a software company, even well-funded startups. The quality of the code is increasing, it's becoming much more substantial. And we talk about this ransomware operation, it comes from where we refer to as malicious operation, where the software component, the ransomware, is itself just a tool of the ransomware operation. Because oftentimes they will buy access maybe from an initial access broker who's compromised a major company, and they'll actually sell that access to someone in the ransomware group. They'll leverage that to then deploy the ransomware. But it is much more than just deploying ransomware, pray and spray. We're actually seeing that it's becoming much more sophisticated, and it's really well-funded. And that's something I think a lot of businesses need to be aware of.

That makes sense. Robert, what about your research? I'm pretty sure you've encountered some fun operations in this area, right?

Yeah, absolutely. I'd say one of the important trends we've noticed is when they're targeting organizations, they may target cloud file sharing. Because that's typically a juicy repo of a lot of important documents, oftentimes used by multiple parties to pass sensitive information back and forth. So we've seen that be heavily targeted. And I'd also add into that attacks on databases that could be hosted in the cloud. So, you know, Ken mentioned the attacks focused on the data itself. I think there have been multiple reports of operations targeting Databases where they may clone the data in a SQL database and then drop the tables and then proceed with their ransom and extortion campaigns.

That does make sense, unfortunately. So, Alicia, you were a CISO very recently, and so you may have had your, hopefully not hands-on experience with some of this stuff, but what's your take on this? Like, how scared were you of ransomware in your CISO days? Were you like slightly nervous or were you like not sleeping at all?

Fortunately, you know, never got my hands dirty actually with that. But certainly from the business perspective and business impact perspective, ransomware has always been at the forefront of my attention and also the companies that I have worked with. And I would say just what was just said before, the commercialization and kind of the commodity character of ransomware, that's what's prevailing. And you can see all sorts of kind of warnings, letters getting through the emails, and then actually some of it is not the real stuff. So it's also important to distinguish that. But there's been other impacts. I mean, we've spoken about the evolution of ransomware. I think we need to look at the cost to the business, even if we are not the victims of ransomware. Insurance, it's far more hard to insure the businesses. There is a far more detailed, let's say, insight the insurers want into your control environment. And actually ransomware is at the forefront of their attention because the ransomware fees, let's say, can be high. It's not only what you are paying, it's also the forensics, the legal, the fines and penalties from the regulators, and then also data recovery. And of course, you don't always recover your data as well. And then you have reputational damage too. So it's, I would say, with the commodity character of the market, it has a bigger kind of impact on the commercial side for the businesses as well.

So it's kind of scarier, not because it's a threat and it's from quote unquote malicious hackers, but it's scary because it's an industry or becoming an industry, right? That's roughly what I'm hearing in some of your response.

Correct.

You're not facing, I hate the clichés, you're not facing a disorganized group or set of threat actors. You're kind of facing a kind of a malicious industry. I hope they don't use it as a term, but it's kind of a malicious industry, right?

Exactly, exactly. And it's, you know, not only financial services, it goes across and it goes across the companies that use cloud services, that don't use cloud services, but also technology providers too.

Yeah, you may use software as a service for your HR, and they back into somebody who is then ransomwared. This whole chained provider thing has been giving nightmares to some people because you don't have a contract with a ransomware victim in this case, but you have a contract with somebody who uses them for something.

That is correct. And with that kind of chain of third parties, then, and a lot of companies using, let's say, the traditional on-premises IT setups, We know challenges of that in terms of the asset registration and in terms of knowing where your data sits as well. It's very difficult and it's laborious to actually find out whether somewhere down the road you have been affected as well. So it's timely investigations, and there is a lot of impact and, let's say, scare until things are clarified.

So I wanted to slightly shift gears and kind of pick on one of the themes that I've heard from all of you. With ransomware, there's, of course, attacks on cloud environments, attacks on on-prem environments. When organizations are compromised, sometimes the attacker isn't really, I'm going to attack the cloud, but they're attacking an organization. So in that sense, I almost had this idea when we were planning the panel that perhaps cloud security is a bit of a misnomer because you have to have secure cloud, but ultimately, you have to secure an organization. So attackers are out to get you overall. They're not going to specialize as we are cloud attackers, we are on-premise attackers. So How are we organized to fight that type of threat? Like, if you look at the vendor, the vendor is, I'm a network security vendor, I'm a cloud security vendor. But who is an organization security vendor? And of course, that's your security team. So, I wanted to open this up to a bit more specific questions. So, is focusing on cloud security alone a misnomer? Like, how should we focus? Alicia, your broad experience is probably quite useful here. So, can you start answering?

Again, if I can put myself in the shoes of the board and the shareholders, you're not just concerned about what's going on in the cloud. Maybe it is the biggest question mark because it's all a new environment, but the board and stakeholders are really concerned with the security of the enterprise. And that enterprise might be cloud, might be on-premises, might be hybrid, might be all sorts of things and heavy dependencies, of course, on the other third party. technology providers as well. And by the way, they shouldn't be just concerned about the cybersecurity risk, it's the overall operational risk and resiliency of these systems. So from that perspective, that side of the coin, let's say the business point of view, I don't think at that level there is a real clear differentiation. Am I gonna be concerned about cloud or on-prem? I have to be concerned about both. So that's one side of the coin. The other side of the coin, of course, if an organization is migrating into cloud or has implemented the cloud and is on its way to digital transformation, those controls become very important and it's a learning curve. And in a way, the particulars of cloud environment and security have to be considered and adopted to be able to support that environment effectively. So, the security team might need to reskill themselves. The policies, perhaps the old won't apply, for sure, won't apply the best into the new. So, we need to rethink them and really manage them as code. So, a very different set of predicaments that one has to deal with. And from that perspective, that's where cloud needs to be treated as a different set of rules to be applied.

So, anybody, Robert or Ken, any comments on this? Because it sounds like you don't work for cloud security vendors, you work for security vendors. Of course, Mandiant deals with issues everywhere, cloud or not, and Cybereason protects on-premise and cloud environments. So, what's your take on this?

Well, I really like Elisa's point regarding, you know, you have sort of on-prem and cloud. And I think that's one challenge we have is this sort of dichotomy in our mind that they're somehow separate in a And we need to, I believe, break those silos down. I often say that DevOps folks are from Venus and security people are from Mars. And that's really common because security, a lot of times they were building primarily for the traditional network that we had before COVID And all of a sudden now everyone has been pushing everything in the cloud. You had people working from remote, you know, to accelerate your migration to the cloud. And a lot of the security teams are still coming up to speed on cloud security. It's a kind of an alien world for them that they're still learning. Still understanding. And on the same kind of side of the coin is that the DevOps folks don't necessarily take security as sort of the forefront when they're developing applications. They have usually different things they need to focus on, things like uptime. They need to focus on, you know, getting the application built and developed and the timelines. So I think what we need to start doing is actually breaking down those silos and having better communication and also better visibility across the tools. 'Cause not only are the teams siloed, but also the data and the visibility is siloed as well. If an attacker gets into an on-prem environment and they deploy ransomware and they're able to pivot into the cloud, I see a lot of times customers, that's where the trail goes cold because they're not bringing those logs into their SIEM, for example, either due to cost constraints or technical restrictions, things like that, or they just didn't consider it. They don't know how to bring that data into their SIEM for that visibility. It's just not designed for it. So I think that's kind of what I would recommend to people is really start to breaking down the silo, start incorporating security into every aspect of the application development lifecycle. And just thinking again, like getting that 30,000-foot view of your overall environments, both on-prem as well as cloud.

Perfect. Robert, anything on this? Of course, incidents take you wherever the attacker takes you. So yours is like a perfect horizontal position, right? If it's from mainframes to Kubernetes, you'd go there, right?

Absolutely. It's all connected. We're focused on following the threats and understanding the technology that's used or exploited or abused during attacks. So our goal is to understand all of it in order to better respond to it and to help our customers remediate and then protect against future attacks going forward.

That makes sense. So I wanted to touch on, give everybody a chance to give their best advice based on the research, based on MTR. trends and cyber reason research, just to see what clients can use. So let's go in order, Robert, Ken, and Alicia. What's your best advice for clients? Cloud security, or perhaps in light of the discussion we just had, maybe broader than that. You can speak for 6 hours only, so just limit your answer to 6 hours.

Okay, I'll limit it to a brief 6 hours, but I mean, I'd say focus on understanding your attack surface. Biggest challenges we notice with a lot of our clients is they may not know what all they have in the cloud or multi-cloud and where they all are. So understanding your attack surface and then continuously testing that is an important component of cloud security. And then I'd say, you know, I'll just shill Mandiant services here for a brief second, but head over to mandiant.com and check out our cloud security assessment service. It's a really robust and thorough assessment of organizations' cloud deployments, and we find it to be tremendously helpful for customers. So that's it for me. I'll hand the baton over to Ken.

Great.

Thank you. You know, one thing we found in our recent ransomware study was that we evaluated the people that actually paid the ransom, and 80% of those people actually were hit with ransomware again, either with the same group or a different group, and it was for more money. And one of the issues with that is they're thinking they could just pay, throw money at the problem. And I think that's one of the challenges challenges that we have in security is just go out, buy another tool. And what we really need to be able to do is not just pay the ransom. We don't want to pay that, but also be able to identify the root cause. Because that's if you pay the ransom, you still haven't identified how the ransomware actors got into the environment. Maybe demand that you'll pay the ransom, but you need a full pen test report to identify how they got into the environment. Just kidding. Never pay the ransom. But there's also that challenge of identifying the root cause. So with EDR, with endpoint detection and response, we've had really good visibility into what's happening on a given endpoint. However, we may not necessarily know how it got there. With maybe it was email phishing, did they compromise a system and then, you know, pivot? And then where did they go? We need to identify the full business impact. Did they move into the cloud? And this is where, you know, I see XDR. A lot of times people think XDR is a marketing term, but I'm really seeing the value in ransomware operations in particular, where you're able to not only identify, hey, these systems were impacted, We also can identify how it got there. It was email. How many other people received the email? Who downloaded the email? Who executed it? We blocked it in our environment. That's great. But then also, you know, what did the operator do from there? We're seeing that they're doing not just one type of extortion where they encrypt the data. We're even seeing triple extortion where they encrypt the data. They'll also exfiltrate the data, make you buy the data, say, hey, if you don't do this, we're going to release it. And on the triple side, we're even seeing them contact customers of them when they compromise that data, telling them that they were hit with ransomware. So making those types of threats as well. And so you really need to identify the full scope of a given incident. The legal team is going to want to know that for compliance issues. And you're also going to need to know that for your full team to be able to do a proper postmortem to ensure that your security posture is increased and it doesn't happen again.

Perfect. That makes sense. And now, Alicia, you have a perfect chance to kind of go take a broad perspective on all that and just give your best advice.

Yeah, absolutely. So I don't want to sound like a rebellious CISO.

And please don't just say save logs because I'd love that, but save logs must be part of it.

I don't want to sound like a rebellious CISO, but really challenge the existing security assumptions, right? And think about cloud-specific best practices as the leverage to modernize your risk management, Not only in security, but actually across the operational risk, because that gives you a power to correlate all the events, which is what we've just spoken about, gives you an ability to have it real-time and absolutely apply to your whole environment, also knowing what your environment is. And another thing is, don't avoid the risk, understand the risk. Don't let risk avoidance to be the stop— showstopper, or perhaps something that really delays your digital transformation and acknowledge that that might mean planning to retrain, reskill, reorganize your teams and break those silos, which is really hard because that means changing the culture. But I think also the outcomes are so fruitful and actually rewarding for all the people involved. And maybe just the last thing is think differently about your attack surface. Again, adopt a different mindset. So don't think just endpoint security, think more zero trust and forget the perimeter. So that's the kind of key things for me.

Thank you. That was a fascinating panel. And I think we extracted some of the very useful lessons from the research and the experiences. I definitely like the theme of how we have to break the silos. It's very hard for many organizations, but ultimately, Security isn't about securing the endpoint, securing the network. It's about securing the organization. And this is really non-negotiable. That's where attackers take us. Just as Robert pointed out, an incident would take you to— may take you to a mainframe, may take you to a container, may take you to a very new environment. So to me, this is probably one of the biggest lessons is while some of us are engaged with cloud security, we do need to transform security so that organizations think like that. Thank you very much for being on the panel.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton underscore Chuvakin and underscore Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.