Building Effective Attack Detection in the Cloud
Talkat Cloud Native Security Day North America 2020 · on Tuesday, 2020-11-17· at 11:05· Virtual , VIrtual·
summary
Cloud-native detection focuses on actual attack paths not buzzwords: it uses control plane audit logs (CloudTrail/Azure Audit/Kubernetes), service-specific logs, and CI/CD/source-repo telemetry to find identity, pipeline and pivot attacks. The team builds Leonidas, a serverless framework that executes scripted TTPs (45 test cases for AWS so far), emits its own logs, and diffs those events against the SIEM so teams can validate detections and run detection as code regression tests automatically.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:25Similarities
- 2:59Telemetry
- 3:45Cloud telemetry
- 4:57Context
- 5:59Interconnectivity
- 8:22Data Sources
- 11:17What is an attacker likely to do well
- 12:15Source code management continuous delivery
- 13:38Threat model
- 15:36Detection as code
- 16:57Leonidas
- 17:49Working with definitions
- 18:30Detection cases
- 18:52Creating a single source of truth
- 19:19Demo
- 28:25Conclusions
related talks
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
37mOptimizing Cloud Detection & Response With Security Chaos Engineering
47mDetection as Code: The Engineering-Focused Future...
41mBuilding a Valid Threat Library for Cloud Based Applications
44mCloud Security Podcast - LIVE!
13mA guide to strengthening your threat detection and response
35mThe Best Defense is a Great Offense: Leveraging Automated...
48mLateral Movement in the Age of Hybrid Cloud