Building a Valid Threat Library for Cloud Based Applications
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 13:30· Westminster- 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Claims a working, evidence-driven threat library that pulls cloud monitoring via Azure Hybrid security dashboard and AWS APIs to correlate attack patterns to CAPEC/CVE entries and feed automated tests using tools like VFeed. Demonstrates attack trees tied to controls, JSON checks (example Redis exposure) and automation that can PUT fixes, cites 24 million alerts and a $750,000 per day loss from tainted field data as drivers for prioritizing fixes.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:37Objectives
- 11:55Pasta Framework
- 20:53Threat Motives
- 24:53The Threat from the Threat Library of Sabotage
- 28:44The Idea behind a Threat Library within a Threat Model
- 32:33Aws
related talks
43mThreat hunting in the cloud
30mBuilding Effective Attack Detection in the Cloud
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
57mEnterprise Ethical Hacking Cloud Applications
46mStories from the cutting edge: Cloud security in 2023
21mMake threats visible in your cloud environment — Eric Jung
31mCloud Threat Landscape - 2021
45mDiving into the Tenacious Threats of Cloud Data Lakes