Cloud-Based Contextual Analysis as Code
summary
Builds a cloud-native graph CMDB (Jupiter 1 / any graph DB like neo4j) that maps users, accounts, IAM roles, security groups, VPCs and S3 buckets and runs graph traversals as code. Shows a complex AWS query that checks seven criteria to detect internet‑facing EC2s with access to non‑public S3. Uses Okta (single sign‑on) correlation and runnable enrichment code from a repo to reduce false positives — initial result 569 -> 47 true no‑MFA accounts, finds system accounts and a few remediations.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 2:06Graph Data Model
- 6:18Example Question
- 9:16Example Use Case
- 12:06False Positives
- 14:21Correlation
related talks
22mInside Out - The Cloud has Never been so Close
11mReducing exposure in the cloud
57mNeptune: Using graphs to gain security insights
55mStreamline security analysis with Amazon Detective
49mContext is everything: CNAPP revolution to secure deployments (PRT254)
45mInternet-Scale Analysis of AWS Cognito Security
48mCatch Me if You Can: Hunting Cloud Exfiltration Using Anomaly Detection
40mMulti-Cloud Anomaly Detection: Finding Threats Among Us in the Big 3 Clouds