Adversaries Also Lift & Shift: Cloud Threats Through the Eyes of an Adversary

The talk opens by widening the definition of cloud to include any provider, system or SaaS application that delivers services online. The speakers argue that cloud adoption is growing faster than cloud security, and they point to a recent incident in which a state-linked group used password spraying against a legacy test tenant without MFA and then reached production systems and source code. The lesson given is that cloud intrusions often need no exploit at all.

From the attacker's side, the speakers explain that cloud consoles and APIs make activity easy to perform and automate, and that misconfigured public storage is a common target. Identity has replaced the network perimeter as the main entry point, whether through phished human credentials or non-human keys left in code repositories. A second case described a stolen non-human credential that opened a storage bucket holding data for many customers, with further keys for other companies inside it. On the defensive side, the speakers describe how cloud offers fewer familiar indicators, logs arrive late and are often off by default, formats differ between providers, SaaS logs may depend on license tier, and responsibility is split across teams.

The closing recommendations are practical. Check that logs are enabled in every region, on every provider and across SaaS platforms, and turn on the native cloud security services each provider offers. Run a red team exercise to reveal visibility gaps, then build behavioural detections based on which APIs are called, in what order and at what timing.