Cloud Security for Developers

How you can prevent data breaches in your organization

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics. The Code

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I originally wrote this post for another organization free of charge but they took it down, so reposting it here because people have asked me for it.

Now more than ever, software developers and engineers are on the front lines, making crucial security decisions. In many cases, responsibility for the deployment of networks, operating systems, and IAM (identity and access management) deployments has shifted from the typical realm of Information Technology and Security teams into the hands of those writing and deploying applications.

Those decisions may result in an even more secure environment with proper automated governance to prevent misconfigurations or the next big data breach. Cloud deployments have been the source of many data leaks in the past few years. An article published by SC Media on August 4, 2020, states:

“Misconfigured storage services in 93 percent of cloud deployments have contributed to more than 200 breaches over the past two years, exposing more than 30 billion records, according to a report from Accurics, which predicted that cloud breaches are likely to increase in both velocity and scale.”

Cybersecurity Risk

Why is this happening? It has to do with the shift in responsibilities to people who are not trained in cybersecurity, making security decisions, and a lack of overall governance in cloud environments that formerly existed on-premises. Governance consists of the methods and processes an organization leverages to ensure people follow company rules and policies. Those rules and policies exist to minimize risks that may impact the profitability of a business, such as costs associated with a data breach. It also ensures the company is abiding by regulations that apply to the organization. Failure to comply with legal requirements related to sensitive data and cybersecurity control implementations may result in fines and business losses.

The objective of my recent book, Cybersecurity for Executives in the Age of Cloud, was to attempt to explain fundamental cybersecurity to executives to help them make better security decisions. At the executive level, cybersecurity is not about specific implementations, network packets, cloud configurations, or analysis of security events. It is about minimizing the overall risk faced by an organization. Cybersecurity risk reduction involves creating and abiding by rules and policies the organization leverages to prevent data breaches or failure to maintain regulatory compliance.

Some basic principles drive cybersecurity risk at the highest level. It is more about understanding statistics and the root causes of data breaches and less about the technical details of implementing security controls. An actuary at an insurance firm may not be an expert in every domain for which he or she sets insurance prices. However, by looking at the factors that drive risk, one can determine the potential for an adverse event to occur. If the factors that typically are associated with the incident exist, chances are the event may happen. Organizations can mitigate risk by measuring and reducing the factors that are most often associated with data breaches.

Risk Reduction and Management

Business requirements that specify risk reduction targets should drive the implementation of cybersecurity controls. That is the premise of my book, which presents 20 questions executives can ask security teams to understand what cybersecurity risks exist in an organization. However, the questions are not quite that simple as I explain and delve into some details related to each one and how to measure it. As you drill down, it becomes more complex with many nuances.

Many small factors drive the big picture metrics that organizations can use to quantify cybersecurity risk. In addition, individual risks add up to what I call cumulative risk. While single factors may not dramatically increase risk, the items as a whole may increase the chances a company will face a data breach significantly. That is why organizations need to manage risk at a macro level, not at the level where a developer is making a single decision about a single application.

At Capital One, I worked on the original cloud engineering team, later implemented networking for applications across the organization, and then moved to the security operations team before another company recruited me away. An organization that size may have 10,000 or more separate developers making individual security decisions at every level. Consider the scenario where an organization gives all developers complete authority to make decisions without any governance or security controls. Chances are high that somewhere along the way, people will make incorrect assumptions and implement less-than-ideal solutions from a security perspective.

People will not do this intentionally in most cases, but because they haven’t don’t have in-depth or sometimes even basic training in how cyber attacks work and breaches happen. They don’t fully understand the implications of their actions and the potential outcome. They also can make mistakes. Who hasn’t?! Even as the decisions move up the chain to architects, managers, and directors, each individual’s choices increase or decrease risk, and as we know from the Capital One breach and many, many others. One unfortunate architecture decision or a single misconfiguration may have costly consequences. That is why organizations have governance and overarching security controls and responsibilities — sometimes those which developers and others don’t like or see the point as to why they exist.

Do we need a security team?

Recently I have been asked several times if the security team is really necessary. Can’t developers do the security team’s job? I would turn this around and ask “Do you think the security team could replace you and do your job?” How would you respond to this question?

You might start listing off all the things the security team doesn’t know about your job and the skills you have acquired over the years by digging into the details of how the technologies you use work. Likely, you know one or more software languages. You probably acquired some skills pertaining to proper architectures, performance, microservices, and maybe multithreading if you’ve been programming for years on complex systems. You are likely well-versed in a good software development lifecycle process if you’ve ever worked for a large company with proper operations for smooth deployments and deliverables that meet business needs and objectives. You may have even learned to automate your cloud infrastructure. You could probably list many more skills and specialties the longer you have worked in the field.

So what about security professionals? Sure, you may understand how an S3 bucket may be misconfigured (which still happens as we can see from recent breaches). How much do you know about the following topics, that your security team may be more focused on:

• Manipulated network packets creating tunnels to exfiltrate data or pass commands through your network undetected in payloads or network protocols like DNS, NTP, and ICMP
• Phishing and social engineering attacks that look like valid requests such as those that just affected companies using Okta
• Attack tactics like web shells, DNS rebinding, SIM swapping, network protocol attacks, and cache poisoning.
• Cryptography flaws caused by different encryption modes
• If and how ARP spoofing might affect your environment (hint: It doesn’t on AWS.)
• How trunking misconfigurations on devices can affect network security you use to connect to the cloud
• Fileless malware
• Kernel-mode rootkits that infect processes on your system in such a way that you can’t tell it’s there by looking at the tools your OS provides
• Proper network architectures and why they exist (no, not to make your life difficult)
• The OWASP top 10 (which is only the top 10) and all the application attacks beyond that
• Threats in the MITRE attack framework
• Ensuring applications receive a proper penetration test, understanding, validating, and ensuring the findings are fixed
• Understanding when vulnerability scan findings don’t matter — like the level of risk when getting an F from some online scanners on a static website. Whether vulnerabilities matter or not depend on the details of the implementation. A security professional understands those details and how attacks work and can demonstrate the impact of a vulnerability, not just report that the vulnerability exists.
• Monitoring systems to ensure they are fully patched. Responding quickly in the case of a new zero day that affects the organization. (I explain zero days in my book if you are unfamiliar with that term)
• Ensuring that infrastructure is aligned with the CIS benchmarks and other cybersecurity best practices from each cloud vendors
• Perform threat modeling, monitoring, hunting, and monitor security intelligence reports
• Some security professionals reverse malware with disassemblers to determine indicators of compromise (IOCs) to update security appliances with rules that can stop future attacks by that malware.
• Some security professionals specialize in breach analysis and ensure that proper chain of custody is followed through the process. Without proper chain of custody your evidence may be thrown out in court.
• Security professionals try to architect enterprise security to reduce the blast radius in the case of a data breach to reduce the impact of the breach and potential fines the company will have to pay.
• Security teams need to prepare for working with law enforcement and your company’s legal team to ensure the best outcome for your company in case of a breach.
• Some security professionals capture system memory in the event of a system compromise and analyze it to determine what happened
• Some decipher network packets to analyze breaches and perform threat hunting activities.
• Security teams may be responsible for monitoring a network and host-based IDS or IPS and updating the rules as new threats arise
• Security teams must understand compliance regulations your organization must adhere to in order to avoid fines and penalties.
• Your security team likely researches top threat actors targeting your particular organization to become familiar with their objectives, which vary by country and crime organization
• One of the most important things security teams do is to monitor the logs constantly to make sure no attackers have infiltrated your organization, so they need access to all logs and generally will consolidate them in a product called a SIEM (Security Information and Event Management system.)

Those are some of the things security professionals learn through years of training and research. If you want to learn even more about the different types of jobs in cybersecurity, check out the video in this post.

I once read a book by an investor who had a neighbor who was a doctor. The doctor was in the elevator one day and said to him, “Would it be possible for me to come over this weekend so you can teach me how you do investing?” The investor replied, “Sure and in return you can teach me how to be a doctor this weekend.”

Discounting what security teams do without understanding the knowledge they have is akin to thinking you can be a doctor without going to medical school. If you want to be an expert at anything at a deep level, you need to drill in and focus on it, probably for many years to become even close to expert level. The more of an expert you want to be, the deeper you need to dive.

Often people say they learn how much they don’t know when diving deeper into a subject, rather than thinking they know everything. I certainly feel this way after 25+ years of software and security engineering and masters degrees in software engineering and information security engineering. I have many security certifications, including the GSE (which required a two-day hands-on in person test at the time I obtained it). Even with all that, I know there is so much more to learn in both fields! I can’t squeeze it all into my brain or learn all the new things I want to know fast enough. I have great respect for experts with more in-depth knowledge than me on specific topics in both fields.

But there are some things developers are likely better at than security teams!

How Software Developers Can Help Reduce Cybersecurity Risk

As developers, the controls implemented by security teams may seem draconian and designed to stop you from getting things done or doing your job. You can’t build as fast. These controls seem pointless because you can’t see why they exist. One of the issues is that the problems security people are trying to solve do not manifest themselves in the same way as problems and solutions developers address. When a developer builds something, the result is something you can see and use.

When a security person implements a control, it is to protect an organization from something they can’t see today (hopefully). They are looking into the future, evaluating threats, and preventing things that may happen if the controls are not in place. They base their decisions on constant analysis of the risks to the environment. This analysis takes time and sometimes years of training to understand the threats and malware that can impact systems at very low levels with intricate changes to software to evade defenses.

Some people have more or less capacity or patience to look at future outcomes, risks, and potential threats. Some want immediate gratification. I want to release this system now! That is a very different viewpoint and objective than one that wants to prevent a future threat. It is perhaps hard to maintain both mindsets at the same time effectively, but this needs to be our goal. Balancing these two objectives and viewpoints will help prevent data breaches, while at the same time enabling organizations to release software as quickly as possible.

Sometimes security professionals may not understand the developer or business mindset. Although a security breach has a potential cost, so does the inability to release new products and services in a timely manner. That is where disparate teams need to come together and understand each other more effectively, and is something I try to help teams at organizations do through the various services we offer at 2nd Sight Lab.

An assessment or penetration test can help teams understand what deficiencies in security controls or vulnerabilities are present in applications and cloud accounts. I also try to explain effective ways of solving those problems in a more holistic manner, having worked both in security and software engineering. A team that learns cloud security together with members of diverse groups across an organization can discuss solutions to problems that help meet business, security, and software development objectives.

One of the critical points developers need to understand is that security is not a one-time implementation of a specific set of security controls. It is not just about their application alone, but the overall risk the organization faces. Just like software development, security skills take years to master.

Security professionals need to understand data breaches, malware, and proper handling of security incidents. Threats exist at many different levels in a system, from the application to the operating system down to individual network packets. Many layers exist that an attacker can exploit, including API calls, containers, and cloud infrastructure, administrative interfaces, network devices, and protocols, to name a few. Security teams are looking at all these layers.

Hopefully, executives are looking at the risk faced by the organization as a whole. To understand the threats effectively, security people need to continually monitor the news and the environment for the latest threats. They will be looking for gaps in the environment that allow an attacker to break in or exfiltrate data. In large organizations with high-security needs, they will be scouring logs every day looking for signs of an attack.

Whenever a security team implements a control, the attackers will find a way around it. Security teams must be vigilant, continuously monitor new threats and attacks, and then adjust systems accordingly. I doubt most developers want to spend their entire day looking at logs or dealing with compliance audits, risk assessments, and related paperwork. They want to build things!

Appreciate the fact that the security team handles those things you may find less than exciting. Understand the bigger picture and the consequences if your organization faces a data breach. Be aware that handling security incidents in large organizations that happen anytime, day or night can be very stressful.

Understand that the team testing your application for security vulnerabilities is there to keep your organization out of the headlines. Rather than fight with the security team to release your project faster, incorporate time to fix security vulnerabilities and implement security controls recommended by your security team into your project timeline.

Security automation is one way developers can help the security team. Repeated events that have consistent inputs and outputs may be automated away to save time and money. By learning more about security, developers can help alleviate some of the pressure on the security team by ensuring repeated security issues are prevented before they occur. They may also be able to implement security monitoring that makes the security team’s job easier.

Some developers may think that they can just automate away all the security problems. That definitely helps, and I am a huge proponent of security automation and explain how to use it effectively in my book. However, as new attacks arise, these automated approaches are bypassed and need to be adjusted to handle new threats. Various scanners and tools capture certain types of vulnerabilities and problems, but some things require manual analysis.

I know this because I try to automate as much as I can while pentesting but often find issues that these automated tools don’t see. Some scanners create a large number of false positives that need to be analyzed to determine if they are indeed a threat or not. Many security incidents still require manual analysis to determine if it is a real incident, a system configuration problem, or user error. Things always look easier if you don’t understand all the nuances and details.

My biggest advice about cloud security for developers is to learn as much as you can concerning any security decisions you influence within your organization. Try to architect and build your systems in ways that reduce the chances a data breach will occur as a result of vulnerabilities in the systems you deploy. At the same time, avoid underestimating what your security team knows or their job.

That goes both ways. Security teams can leverage the skills of developers to automate and improve security outcomes. The two groups working together will produce the best results. Leveraging proper security controls, DevOps, and security automation will help bring those breach statistics I mentioned at the beginning of this article down. Software developers play a big part in making that happen.

By partnering with your security team, who has in-depth knowledge of how malware and data breaches occur, you can help implement technology to reduce cybersecurity risk within your organization rather than exacerbate the problem.

Want to learn more about cybersecurity? Here are some suggestions to help you get started.

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab