Source Zero Con: The Evolution of Cloud Forensics and Incident Response

### Overview In this talk from Source Zero Con, Optiv Cloud Architect Ramy Rockman examines the evolution of cloud forensics and incident response (IR), emphasizing common misconfigurations observed across multi-cloud environments (AWS, Azure, GCP). Rockman shares statistics gathered across 12 client environments, demonstrates a live mock attack leveraging misconfigured AWS IAM roles and AWS Systems Manager, and discusses defensive architectures such as Cloud Security Posture Management (CSPM), Cloud Infrastructure Entitlement Management (CIEM), and Cloud Workload Protection Platforms (CWPP) versus Endpoint Detection and Response (EDR).

### Key Topics - **Multi-Cloud Misconfiguration Trends**: Analysis of client environments revealed pervasive security gaps: 1,551 instances where VPC or NSG flow logs were disabled due to cost concerns or oversight; 133 IAM users lacking multi-factor authentication (MFA); 27 root accounts without MFA; and over 50,000 EC2 instances with Instance Metadata Service Version 1 (IMDSv1) accessible rather than IMDSv2. - **Mock Attack Demonstration**: Using compromised AWS IAM credentials without MFA from an external IP (simulated via NordVPN), Rockman demonstrates access to the AWS EC2 console. By attaching the `AmazonSSMManagedInstanceCore`/quick setup role to a running EC2 instance named `sub-zero`, the attacker establishes an interactive session via AWS Systems Manager Session Manager. This grants root access without SSH keys, enabling local privilege escalation, local key generation, and the creation of an unauthorized backdoor user (`scorpion`). - **Logging Blindspots**: Default configurations in AWS Systems Manager do not log session commands to S3 or CloudWatch unless explicitly configured. While commands are recorded locally on the host OS, investigating per-instance locally does not scale during incident response. - **Tooling Comparisons (CWPP vs. EDR)**: Comparing tools such as Palo Alto Networks Cortex XDR and Prisma Cloud, Rockman explains that EDR offers interactive live terminal and command response capabilities to remediate or restore compromised accounts, whereas CWPP solutions provide cloud-native workload protections including runtime security, built-in vulnerability scanning, and Web Application Firewall (WAF) capabilities against OWASP Top 10 vulnerabilities.

### Technical Details - **IAM and CIEM**: IAM privileges in the cloud have broad blast radiuses. CIEM tools evaluate net effective permissions and provide Just-Enough-Privileges controllers to broker and minimize role access. - **Network & Activity Monitoring**: Centralizing VPC/NSG flow logs allows CSPM tools to detect anomalous traffic, such as forgotten sandbox instances communicating with suspicious external IPs. - **Governance Guardrails**: Cloud organizations (AWS Organizations / GCP) should enforce Service Control Policies (SCPs) to disable unused regions and enforce guardrails preventing insecure baseline configurations.

### Takeaways - **Back-to-Basics Hygiene**: Mandate MFA across all accounts—especially root and IAM privileged roles—and ensure logging is turned on by default (VPC/NSG flow logs, CloudTrail, CloudWatch, and Session Manager logging to S3). - **Modernize Incident Response**: Update traditional on-premises IR playbooks for cloud-native services and align detection and investigation workflows with the MITRE ATT&CK Framework for Enterprise Cloud. - **Layered Host Defense**: Combine CSPM for configuration and drift monitoring with CWPP and EDR solutions to monitor host processes, containerized workloads, and command-line execution.