Randall Hettinger

Threat actors can be challenging to detect due to the use of valid credentials, role assumption, and the absence of direct IAM user activities. The attacker, once in possession of valid credentials, can assume a role with elevated privileges, blending malicious actions with legitimate ones and evading traditional security monitoring tools that primarily focus on IAM user activities. Limited visibility, the lack of direct IAM user engagement, and the potential alignment of the attacker's behavior with typical role usage patterns contribute to the difficulty of identifying malicious activities.

Organizations need a comprehensive threat detection approach supported by a robust library of detection signals, starting at the identity provider level. Effective log management and analysis requires multi threading access and activity in and across IaaS, SaaS, IDP, CI-CD environments, at runtime and scale, in order to baseline normal behavior, detect anomalies and respond.

The Control Plane is pivotal in Cloud Incident Response. It provides centralized control and visibility, enabling efficient monitoring and response across diverse cloud infrastructures from a single point. Cloud environments generate vast logs and data. While insightful, the sheer volume can be overwhelming. Effective log management and analysis tools are crucial for extracting relevant information during incidents

Most organizations do not adhere to the true principle of least privilege. Most human and vendor identities in your environment are massively over permissioned. For your human identities, start by analyzing permissions and access granted vs used and continuously calibrate towards least privilege. For your vendors identities, analyze permissions granted vs used and have the candid conversation with your vendors on why they require X permission. Like human identities, most vendor identities are massively over permissioned, creating unnecessary risk. Unobstructed runtime visibility across your identity control plane is required to baseline access and behaviour. From your baseline, incrementally tune down

Most security teams lack visibility into attacks wagered against the identity control plane. Logs and events from your cloud identity provider need to be correlated with logins and activity in other cloud environments. Activity in one environment may not appear suspicious at first glance, but by multi-threading other activity is could present a malicious event. IAM and Security Teams must bridge the visibility divide between the IdP and other environments as threat actors are exploiting these blind spots. Most apply impossible travel rules, but this is insufficient threat detection for the modern threat actor that is increasingly targeting the identity layer of cloud

Identities are your perimeter in cloud. Learn, identify, and share broadly across Security and IT Teams playbook of how threat actor groups operate in the cloud (Iaas/Saas/IDP/CI-CD) and what TTPs to look for in your environment. Build a playbook based on threat reports by security companies and what has been seen internally. Breakdown barriers that hinder visibility and complete context of an identity and its resource activities. TAs, like Scattered Spider, are using native cloud features/functions against targets which is difficult to detect. Many cloud security tools have swimlane views, TAs are exploiting those blind spots. Need to correlate and contextualize identity and activity in and across, for example IaaS layer, SaaS app, etc.