Detecting Suspicious Activity on AWS Using Cloud Logs

AWS presents a big spectrum of companies and compute. The “shared accountability” mannequin in cloud presents a simplified construction of group obligations and cloud supplier obligations. Typically, identification and entry administration (IAM), purposes, and knowledge kind the dividing line, however traces blur relying on the given cloud service the group is consuming. That is true of all cloud suppliers, together with the AWS Shared Duty Mannequin.

Deployment errors, misconfigurations, use of weak AMI or container photos, or different modifications made to AWS service configurations create safety issues for organizations, exposing it to attainable safety incidents or breaches. We’ve seen no scarcity of tales about ransomware assaults, privilege escalation, system compromise, knowledge exfiltration, malicious cryptomining, and different unfavourable outcomes.

Detecting high-risk occasions in cloud and container environments is commonly described as discovering a needle in a haystack. Whereas AWS offers some native instruments to assist a few of which carry further price, many organizations endure from knowledge overload that straight impacts their safety program efficacy and talent to reply shortly to safety occasions.

CloudTrail has me lined, proper?

CloudTrail is ubiquitous, totally managed logging service that underpins most AWS service choices. All actions taken by person identities, machine identities, or different AWS companies are recorded as occasions. The newest occasion historical past is saved and visual automagically in CloudTrail. For longer retention durations although, organizations should configure a Path (which makes use of AWS S3 basic goal storage) or a Lake (which makes use of different AWS managed storage).

These are vital distinctions to remember. Whereas CloudTrail is enabled by default and up to date occasion historical past is a given, most organizations want prolonged retention to fulfill compliance, preserve prolonged audit trails, or to help safety use instances like digital forensics and incident response (DFIR). In some instances, organizations could neglect or intentionally skip this further step out of naivety or to keep away from overloading logs and driving up cloud bills.

Finest practices for CloudTrail embody:

• Configure CloudTrail for all organizational AWS accounts and areas.
• Encrypt CloudTrail log recordsdata at relaxation.
• Allow integrity validation of CloudTrail log recordsdata.

As a company’s structure inside AWS and consumption of assorted AWS companies will increase, the amount of occasions and respective log sizes can enhance exponentially. This actuality is especially true as organizations embrace greater ranges of automation, undertake microservice architectures, and/or create API-based designs as machine communications skyrocket and supporting containerized or serverless compute is rather more ephemeral. Whereas some issues that existed in conventional datacenter environments are much less of a problem in cloud, akin to strict limitations on storage as a result of accessible disk capability, new issues take their place. Mountains of log knowledge can shortly overwhelm most organizational IT and safety groups.

How do you establish which occasions are precise threats?

Organizations usually depend on a number of requirements, frameworks, greatest practices, and regulatory necessities to tell their very own safe defaults. A mix of approaches and tooling are used to validate and implement configurations throughout design, improvement, construct, and supply, after which constantly in manufacturing. The barrage of frequent safety actions consists of IaC scanning, picture scanning, infrastructure scanning, cloud posture evaluation, runtime profiling, and runtime detection and response.

Figuring out the precise safety danger of an occasion in manufacturing requires sufficient baselines to know what needs to be “regular” for a company’s environments. Identified vulnerabilities (e.g., CVE-IDs), misconfigurations, and risk actors (e.g., threats outlined inside TI feeds) are actually a begin, however utility exercise, knowledge entry, and identification behaviors are distinctive for every group.

Occasions and log entries for basic environments could also be doubtlessly dangerous, however they might even be anticipated for organizations’ distinctive environments and architectures. For instance, it might be regular to count on AWS S3 bucket creation or deletion within the surroundings, however this could solely maintain true when initiated by a privileged person (not a machine identification) and by no means originating from a containerized workload. Such exercise may additionally solely be anticipated by way of the AWS CLI or acceptable API calls from trusted IP deal with ranges, akin to from the group’s on-premises datacenter or VPN.

CloudTrail captures all occasions inside an AWS surroundings, however CloudTrail has no idea of protected vs. dangerous occasions. CloudTrail additionally has no inherent alerting functionality. Practitioners should engineer round CloudTrail to help their safety use instances together with alerting, risk detection, forensics, incident response, and risk searching.

How does stream detection assist with risk detection?

Organizations attempt to detect misconfigurations within the cloud environments with a wide range of approaches, every with its personal potential pitfalls:

• Cloud safety posture administration (CSPM) – use a scanning course of, akin to API polling, at sure intervals to iterate via all service settings in an AWS account. Gathering and analyzing these snapshots to uncover disparities takes time. Polling intervals could also be 24 – 36 hours in some instances. If an attacker succeeds in tampering or exploiting your tenant after a snapshot is taken, the CSPM received’t detect the occasion till the following polling interval.
• Native cloud supplier configuration evaluation – like CSPM, these choices usually use a snapshot method with polling intervals. An instance consists of AWS Safety Hub, which displays 12-hour latency leaving a doubtlessly massive window of publicity for organizations.
• SIEM ingestion and alerting – export log recordsdata to a SIEM, which can devour further processing time and expense for storing and analyzing logs. The SIEM could already be overloaded with knowledge within the hopes that it might nonetheless produce significant alerts for a big spectrum of occasions past simply cloud and container occasions akin to e-mail phishing or ransomware assaults. This method may endure from the identical window of publicity but in addition alert overload since all occasions could seem suspicious. Ingesting cloud and container knowledge at scale nearly all the time exacerbates the issues of gradual MTTD and MTTR.
• Guide log file evaluation or risk searching – because the identify signifies, detection relies purely on the experience of a safety analyst and their means to unearth significant alerts from occasion noise.

Efficient cloud detection and response capabilities should increase actionable alerts the second an occasion seems in CloudTrail that’s indicative of a risk. Such detection functionality additionally shouldn’t add prices that impression safety budgets or delays that create pointless home windows of publicity.

The mix of Sysdig for telemetry gathering and Falco as a unifying risk detection engine can energy a stream detection method. Falco can consider each CloudTrail entry in actual time towards a versatile set of safety guidelines. These guidelines can alert or take an acceptable responsive motion to help the group’s cybersecurity targets with out delays which are inherent in different approaches.

To be taught extra, go to Sysdig.