Identifying Toxic Combinations of Permissions in Multi-Cloud
Michael Raggo examines toxic combinations across 24,000 cloud permissions in AWS, Azure, and GCP, mapping privilege escalation graphs.
Summary
The Sprawl of 24,000 Multi-Cloud Permissions
With over 10,000 permissions in AWS and thousands more in Azure and GCP, enterprise IAM architectures contain vast matrices of overlapping authorization rules.
Defining Toxic Permission Combinations
Michael Raggo explains how two individually benign permissions (such as iam:CreatePolicyVersion and iam:SetDefaultPolicyVersion) combine into lethal privilege escalation vectors.
Graph-Based Analysis of Cloud Attack Paths
Raggo demonstrates graph modeling techniques that map non-linear attack pathways from unprivileged developer identities to full cloud organization admin.
Automated Detection and Least-Privilege Remediation
The author presents automated policy analysis tools to audit IAM policy documents and eliminate dangerous permission pairings across multi-cloud environments.
Related talks
Cloud Village·27 min
Leo Tsaousis
Exploiting AWS Cognito misconfigurations to achieve privilege escalation and account takeover.
Main Stage·37 min
Yakir Kadkoda · Michael Katchinskiy · Ofek Itach
Six critical attack vectors exploiting implicit and internal shadow resources created by AWS services to achieve cross-tenant and account takeover.
Main Stage·40 min
Dylan Ayrey · Allison Donovan
Dylan Ayrey and Allison Donovan dissect Google Cloud Platform's security model, exploiting default service account permissions and `actAs` delegation to escalate privileges.