avatarTeri Radichel

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

6372

Abstract

ctoring-existing-code-to-use-iam-naming-conventions-part-2-143fd73ecbdf"> <div> <div> <h2>Refactoring Existing Code to Use IAM Naming Conventions: Part 2</h2> <div><h3>ACM.43 Simplifying User and Group creation with reusable templates and functions</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*Pb-tmYuCumbL8XpbkTJ3wA.png)"></div> </div> </div> </a> </div><div id="be1f" class="link-block"> <a href="https://readmedium.com/refactoring-existing-code-to-use-iam-naming-conventions-part-3-fe2cec046be1"> <div> <div> <h2>Refactoring Existing Code to Use IAM Naming Conventions: Part 3</h2> <div><h3>ACM.44 Ensure group names and policy names are consistent</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*DejCdUp_fRbcFtUmpEOdgg.png)"></div> </div> </div> </a> </div><p id="5543">Part of the above includes a common functions file used for deployment of all resources. This is still relevant as I start my AWS account over from scratch.</p><p id="9be5">I’ve decided to try integrating with Okta to prevent privilege escalation as described in these posts.</p><div id="e522" class="link-block"> <a href="https://readmedium.com/backdoors-and-privilege-escalation-via-cloud-account-users-298b54a45f30"> <div> <div> <h2>Backdoors and Privilege Escalation Via Cloud Account Users</h2> <div><h3>ACM.134 Preventing a user from leveraging another user with permissions they don’t have</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*o2-oz7KOX7_NPgI8FyoTlg.png)"></div> </div> </div> </a> </div><div id="22ad" class="link-block"> <a href="https://readmedium.com/mitigating-createuser-privilege-escalation-and-back-doors-d84ee7ef7d85"> <div> <div> <h2>Mitigating CreateUser Privilege Escalation and Back Doors</h2> <div><h3>ACM.143 Preventing an attacker from creating a backdoor user in your cloud account</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*CkEFLvick4Ca93NLIriYAg.png)"></div> </div> </div> </a> </div><p id="b2c6">My code for IAM roles is still relevant but needs to be modified to match the format from roles used with SAML federation.</p><p id="b0f0">All the other IAM policies and roles I created are still valid, but they will need to be modified to be SAML roles — and I’m going to keep both the IAM and the SAML roles in the directory so people can use whichever one works in their own environment. I’m not sure I will still use AWS Groups.</p><p id="1d61">Once I get the IAM structure rebuilt, a lot of the rest of the code will remain the same. We’ll still use the single KMS key CloudFormation template I created to deploy keys throughout our organization, but we’ll probably start taking a look at cross-account access.</p><div id="50b2" class="link-block"> <a href="https://readmedium.com/generic-aws-kms-key-deployments-825865a89c1a"> <div> <div> <h2>Generic AWS KMS Key Deployments</h2> <div><h3>ACM.17 Creating a reusable KSM Key Template for Batch Jobs</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*VZCR_0XTPhSB49x0ZkNigw.png)"></div> </div> </div> </a> </div><p id="1dc4">Note that key policy above got some modifications as I discovered some issues as the series progressed. Read all the KMS posts for more information and some issues you may want to be aware of related to AWS KMS.</p><p id="580c">Our network architecture is also reusable. That doesn’t change much. See the bottom of this list for the network related posts.</p><div id="28af" class="link-block"> <a href="https://readmedium.com/network-security-68e1f26db9df"> <div> <div> <h2>Network Security</h2> <div><h3>Blog posts, papers, and articles on Network Security by Teri Radichel</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*v_31SwDbGzO2jZk7HfOKEw.png)"></div> </div> </div> </a> </div><p id="04fa">I’m finding a lot of rabbit holes as I implement all this code. I start out in one direction and end up down a windy path exploring some other security problem or requirement that popped up along the way. It’s all part of something I’ve wanted to do for a long time — create a code framework for secure cloud infrastructure from the ground up in a new account and organization. We can’t just skip over inconvenient details. In fact, I wrote about inconveniences as they relate to security here:</p><div id="4a9d" class="link-block"> <a href="https://readmedium.com/would-you-accept-an-inconvenience-to-prevent-a-data-breach-f0df9de628e9"> <div> <div> <h2>Would You Accept an Inconvenience To Prevent a Data Breach?</h2> <div><h3>ACM.137 Addressing the rise in credential and session compromise</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*Wo5bH-8HUbMrJMvlwuomXw.png)"></div> </div> </div>

Options

</a>
    </div><p id="6613">I like to think of this blog series like those people who watch people play video games online. You get to watch me write and troubleshoot code, though I’m not doing it on a live video stream (yet). I have a general outline but the posts will evolve as I go.</p><p id="0932">I’ve started putting a few of the posts behind a paywall because this is a very time-consuming endeavor and yes, I do need to make a living. We’ll see how that works out. Perhaps Medium will pay me more than $2 per month. It already increases my payments a bit but nowhere near what I would need to do to write full time and publish more than one post daily.</p><p id="5ac1">As I get into the details of building out an IdP — it starts getting complicated and even more time-consuming. Also, Okta is not cheap. For anyone following along who dislikes paywalls, I get it. I have a hard time paying for every news source that wants me to pay for a subscription. But consider this: You could pay for a $7,000 class such as those I used to teach for a certain organization.</p><p id="20ce">Or you could help an author out and sign up for Medium using my referral link instead.</p><div id="2f0e" class="link-block">
      <a href="https://2ndsightlab.medium.com/membership">
        <div>
          <div>
            <h2>Join Medium with my referral link - Teri Radichel</h2>
            <div><h3>Read all of Teri Radichel's Cyber Security and Cloud Security Posts Your membership fee directly supports Teri Radichel.</h3></div>
            <div><p>2ndsightlab.medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*kJlvteN82sD-g5SW)"></div>
          </div>
        </div>
      </a>
    </div><p id="6810">You’ll get a daily does of actionable cloud security tips to help you improve the security in your cloud account. You may also obtain enough knowledge to pass an AWS security certification if you’re into that. I’ll cover it all eventually, if I can.</p><p id="89f3">But here’s what I don’t know. I get the most income when I refer a new subscriber, but I have no way know if I actually got paid for someone I referred. If you do sign up as a referral from me, please let me know so I can see if I get the corresponding referral fee. Because right know I get exactly one referral per month — always — which seems odd. Never zero or two or five— always one.</p><p id="7a8e">I get a few other cents when people read or like posts but I don’t even get how it all works. I’m too busy to figure it out.</p><p id="e13c">An alternative to the paywall would be to spend a lot of time turning this into a book, pay an editor, and put the final chapters in the book like I did with my series on cybersecurity for executives. You would need to buy the book to get the final chapters which I think cover the most important aspects of organizational security. Also the book will have less typos. :)</p><div id="b8b2" class="link-block">
      <a href="https://readmedium.com/cybersecurity-for-executives-table-of-contents-3e3a4104c31b">
        <div>
          <div>
            <h2>Cybersecurity for Executives: Table of Contents</h2>
            <div><h3>I’m writing a modern book on cybersecurity for executives ~ one blog post at a time. Here’s a list of the posts I’ve…</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*3KyPWD_Kb39tryad_YPo2g.png)"></div>
          </div>
        </div>
      </a>
    </div><p id="4923">It’s hard to know how to proceed as an author because there’s so much information out there and you want to make sure you’re providing value. At the same time, authors need to earn a living too. No, I do not want to write a book for Packt or teach classes through a third-party. People can reach out directly if they want to take a class from me on LinkedIn. I write classes as well. The most recent class I taught was a 6 week two hour class on Azure security. I do teach classes through IANS Research but you will have to work with them to arrange a contract with a 50% up front payment.</p><p id="5b9f">In any case, I will continue to publish some free and some paid posts in an effort to help as many people as possible as I work through this secure cloud architecture from scratch. I also appreciate if people post issues on GitHub and I’ll try to fix them. I don’t always see them right away but I will get to them eventually. The code is all out there for free — no paywall at this time. :)</p><p id="f97a">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="5a42"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="faf5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

Baking Security In From the Ground Up on AWS

Starting from scratch in a new AWS account and building out a secure architecture

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics. The Code.

🔒 Related Stories: Cloud Architecture | Cybersecurity

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

When I initially started writing this series on Security Metrics Automation, I was going to create a basic security architecture for secure automation of batch jobs. I actually want to use this framework in my own business for penetration tests and security assessments.

The problem was as I got down the line using an account where I had deployed AWS Control Tower and was using AWS SSO from AWS Identity Center I hit too many issues. I decided to start over at that point and build out a new AWS account and organization from scratch using AWS IAM, possibly with Okta as an IdP. (You could also user Azure AD in a similar manner). I have tried to use AWS Control Tower and AWS SSO but just finding too many issues.

Here’s the initial post where I started rebuilding with some explanation of why. It provides a lot of security recommendations you should consider when you create a new AWS account, so things ended up being a bit out of order.

If you want to follow along and build out an account from scratch you can start here and follow along.

From that point forward I will built out everything I’ve done so far in a new AWS account. Anyone following along can test and build out their own account and learn cloud security in the process. The concepts are also applicable to Azure and GCP, which I mention periodically, but the terminology and specific implementation will vary.

So does starting over in a new account mean I’m going to have to throw out all the code I’ve already written? Absolutely not. I’m already re-using the code I used to deploy CloudFormation stacks with a naming convention that helps you:

  • Identify the resource type
  • Identify who deployed it
  • Only allow a role modify their own stacks.

Part of the above includes a common functions file used for deployment of all resources. This is still relevant as I start my AWS account over from scratch.

I’ve decided to try integrating with Okta to prevent privilege escalation as described in these posts.

My code for IAM roles is still relevant but needs to be modified to match the format from roles used with SAML federation.

All the other IAM policies and roles I created are still valid, but they will need to be modified to be SAML roles — and I’m going to keep both the IAM and the SAML roles in the directory so people can use whichever one works in their own environment. I’m not sure I will still use AWS Groups.

Once I get the IAM structure rebuilt, a lot of the rest of the code will remain the same. We’ll still use the single KMS key CloudFormation template I created to deploy keys throughout our organization, but we’ll probably start taking a look at cross-account access.

Note that key policy above got some modifications as I discovered some issues as the series progressed. Read all the KMS posts for more information and some issues you may want to be aware of related to AWS KMS.

Our network architecture is also reusable. That doesn’t change much. See the bottom of this list for the network related posts.

I’m finding a lot of rabbit holes as I implement all this code. I start out in one direction and end up down a windy path exploring some other security problem or requirement that popped up along the way. It’s all part of something I’ve wanted to do for a long time — create a code framework for secure cloud infrastructure from the ground up in a new account and organization. We can’t just skip over inconvenient details. In fact, I wrote about inconveniences as they relate to security here:

I like to think of this blog series like those people who watch people play video games online. You get to watch me write and troubleshoot code, though I’m not doing it on a live video stream (yet). I have a general outline but the posts will evolve as I go.

I’ve started putting a few of the posts behind a paywall because this is a very time-consuming endeavor and yes, I do need to make a living. We’ll see how that works out. Perhaps Medium will pay me more than $2 per month. It already increases my payments a bit but nowhere near what I would need to do to write full time and publish more than one post daily.

As I get into the details of building out an IdP — it starts getting complicated and even more time-consuming. Also, Okta is not cheap. For anyone following along who dislikes paywalls, I get it. I have a hard time paying for every news source that wants me to pay for a subscription. But consider this: You could pay for a $7,000 class such as those I used to teach for a certain organization.

Or you could help an author out and sign up for Medium using my referral link instead.

You’ll get a daily does of actionable cloud security tips to help you improve the security in your cloud account. You may also obtain enough knowledge to pass an AWS security certification if you’re into that. I’ll cover it all eventually, if I can.

But here’s what I don’t know. I get the most income when I refer a new subscriber, but I have no way know if I actually got paid for someone I referred. If you do sign up as a referral from me, please let me know so I can see if I get the corresponding referral fee. Because right know I get exactly one referral per month — always — which seems odd. Never zero or two or five— always one.

I get a few other cents when people read or like posts but I don’t even get how it all works. I’m too busy to figure it out.

An alternative to the paywall would be to spend a lot of time turning this into a book, pay an editor, and put the final chapters in the book like I did with my series on cybersecurity for executives. You would need to buy the book to get the final chapters which I think cover the most important aspects of organizational security. Also the book will have less typos. :)

It’s hard to know how to proceed as an author because there’s so much information out there and you want to make sure you’re providing value. At the same time, authors need to earn a living too. No, I do not want to write a book for Packt or teach classes through a third-party. People can reach out directly if they want to take a class from me on LinkedIn. I write classes as well. The most recent class I taught was a 6 week two hour class on Azure security. I do teach classes through IANS Research but you will have to work with them to arrange a contract with a 50% up front payment.

In any case, I will continue to publish some free and some paid posts in an effort to help as many people as possible as I work through this secure cloud architecture from scratch. I also appreciate if people post issues on GitHub and I’ll try to fix them. I don’t always see them right away but I will get to them eventually. The code is all out there for free — no paywall at this time. :)

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab
Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation
Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
AWS
Security
Cloud Security
Architecture
Governance
Recommended from ReadMedium