Instructor: In this lesson, 2 2
we're going to explore how you can audit cloud services 3 3
using some common tools during your engagements. 4 4
This includes tools like ScoutSuite, Prowler, 5 5
Pacu, CloudBrute, and Cloud Custodian. 6 6
First, we have ScoutSuite. 7 7
ScoutSuite is an open-source tool written in Python 8 8
that can be used to audit instances and policies 9 9
created on multi-cloud platforms such as AWS, 10 10
Microsoft Azure, and Google Cloud 11 11
by collecting data using API calls. 12 12
After being run, ScoutSuite will compile a report 13 13
that lists out all the VM instances, 14 14
storage containers, IAM accounts, data, and firewall ACLs, 15 15
that's able to gather information about. 16 16
This tool allows you to write custom rule sets as well 17 17
that you can use during your scans. 18 18
This way, you can highlight or flag things 19 19
when there's a policy violation that exists. 20 20
For instance, you can create a rule in ScoutSuite 21 21
to identify any users 22 22
who do not have multifactor authentication enabled. 23 23
To do this, you'll create a rule like this, 24 24
description: Users without MFA, 25 25
dashboard_name: Users, 26 26
path: iam.users.id, 27 27
conditions: and. 28 28
We want IAM users ID with key and login profile 29 29
also having IAM users ID MFA devices being empty. 30 30
If we have these two conditions, 31 31
that tells me that we don't have MFA enabled. 32 32
keys: iam.users.id and id_suffix: mfa_enabled. 33 33
As you can see, setting up these rules is pretty simple 34 34
and they're basically in JSON format. 35 35
As long as you understand what the keys are 36 36
and what the IDs are that you need to add in there, 37 37
which you can find using AWS' documentation, 38 38
you'll be able to set up 39 39
some pretty complex rules pretty quickly. 40 40
The second tool we have is called Prowler. 41 41
Prowler is an auditing tool that only works 42 42
with Amazon Web Services. 43 43
Prowler is used to evaluate a cloud infrastructure 44 44
against the Center for Internet Security's 45 45
benchmarks for AWS, 46 46
as well as scanning for compliance against GDPR 47 47
and HIPAA regulations and checklists. 48 48
Prowler is an open-source security tool 49 49
that's used to perform security best practice assessments, 50 50
audits, instant response, continuous monitoring, 51 51
hardening, and forensic readiness for AWS cloud services. 52 52
This tool is able to check for compliance 53 53
against over 200 different controls, 54 54
and it's really helpful 55 55
in trying to ensure a target organization 56 56
is meeting or exceeding their regulatory requirements. 57 57
Prowler is a command line tool, 58 58
and it can create a report in HTML, CSV, or JSON formats, 59 59
as well as having the ability 60 60
to directly submit their findings 61 61
to the Security Hub. 62 62
You could also do specific checks in groups 63 63
during your assessment, 64 64
or you can even create your own checks and own rule sets. 65 65
Prowler is really useful 66 66
if you need to check multiple AWS accounts in parallel, 67 67
such as when an organization has multiple accounts 68 68
or sub-brands that you need to assess 69 69
in your scope of work. 70 70
The third tool we have is known as Pacu. 71 71
Pacu is an exploitation framework 72 72
that's used to assess the security configuration 73 73
of Amazon Web Services or AWS accounts. 74 74
This tool includes several modules 75 75
so your teams can attempt exploits 76 76
such as obtaining API keys 77 77
or gaining control over a VM instance. 78 78
Pacu focuses on the post-compromised phase, 79 79
so the team can then drill down into that system 80 80
and escalate their privileges, 81 81
launch additional attacks, or install back doors. 82 82
Personally, I like to think about Pacu 83 83
as a tool like Metasploit, 84 84
but one that's focused specifically 85 85
on attacking AWS-based cloud services and infrastructure. 86 86
Fourth, we have CloudBrute. 87 87
CloudBrute is used to find a target's infrastructure, files, 88 88
and apps across the top cloud service providers 89 89
including Amazon, Google, Microsoft, DigitalOcean, 90 90
Alibaba, Vultr, and Linode. 91 91
This tool works essentially like a web crawler 92 92
or brute force directory listing tool, much like DirBuster, 93 93
but it's focused specifically on cloud-based resources. 94 94
These resources include things 95 95
like object storage, virtual machines, containers, 96 96
and other cloud resources and services. 97 97
Fifth, we have Cloud Custodian. 98 98
Cloud Custodian is an open-source cloud security, 99 99
governance, and management tool that's designed 100 100
to help administrators create policies 101 101
based on their different resource types. 102 102
Cloud Custodian is a stateless rules engine 103 103
that we can use to manage AWS environments by validating 104 104
and enforcing the environment against set standards. 105 105
By using Cloud Custodian, 106 106
you can run a scan against a target's cloud environment, 107 107
identify which policies are being enforced, 108 108
and which vulnerabilities may exist. 109 109
As a network defender, 110 110
you can use Cloud Custodian to also automatically correct 111 111
the vulnerabilities that are found 112 112
by enforcing new security policies in the cloud environment. 113 113
Cloud Custodian is a great tool 114 114
for defining rules that can enable 115 115
a well-managed cloud infrastructure that is secure 116 116
and optimized to save your organization money 117 117
by turning off resources 118 118
outside of normal business hours as well. 119 119
This is known as garbage collection 120 120
where unused or underutilized resources can be deleted 121 121
and free up more of your budget for useful cloud services 122 122
that your organization actually needs.