Auditing the external exposure of cloud assets
Starting from the shared-responsibility model you inventory the organisation’s cloud assets, then find and close public storage, overly wide security groups, shared disk images and leaked access keys.
Level 401 · 16 lessons · 18 practice labs
Lessons
Visibility in the cloud
- Shared responsibility: what the provider protects and what you protect
- Cloud asset types: storage, virtual machines, serverless, content delivery
- Cloud IP ranges and telling which resources are yours
- Short task: build the fictional organisation’s cloud asset list
Storage and network
- Finding and closing public object storage
- Reading and narrowing storage access policies
- Security groups: management ports open to the internet
- Shared disk snapshots and backups
- Short task: find the open storage in the lab, fix the policies and verify
Services and identity
- The instance metadata service: why it needs protecting and how to limit it
- Serverless function endpoints without authentication
- Detecting and revoking leaked access keys
- DNS records pointing at deleted cloud resources
- Short task: find a leaked key in a code repository and run the revocation process
Continuous auditing
- Introduction to cloud security posture tools
- Capstone: audit a fictional organisation’s cloud exposure and write a closure plan
Practice labs
- Build a fictional company's cloud asset list: List the storage, virtual machine, function and content-delivery resources in Göktaşı Yazılım's lab cloud account in one table.
- Separate the company's own cloud addresses: Match cloud addresses seen in the external scan with the account records and remove those not owned by the company from scope.
- Validate the findings of a cloud posture audit tool: Run a posture audit on the lab cloud account, weed out false positives from the top ten findings and assign the real ones to owners.
- Find a publicly readable storage bucket: List the access settings of the storage buckets in the lab account and record the one open to anonymous reads, with its contents, as a finding.
- Read and narrow a bucket access policy: Narrow Ayçiçeği Gıda's over-broad bucket policy so it allows only the application role, and verify that outside access is closed.
- Close publicly shared disk snapshots and backups: Find publicly shared disk snapshots and backups, remove the sharing, assess the secrets they contain and write the rotation list.
- List management ports open to the internet: Find SSH and remote-desktop rules open from anywhere in the lab account's security groups and tabulate them.
- Restrict an open management port to the management network: Open the management port of Turnalı Perakende's virtual machine only to the jump host's address and verify outside connections are refused.
- Clean up unused and over-broad rules: Use flow logs to find rules that see no traffic or are broader than needed, apply the removal plan and verify the services still work.
- Audit the metadata service setting on virtual machines: List whether the lab VMs' metadata service requires session tokens and flag the ones still in legacy mode.
- Switch the metadata service to token mode and verify: Configure the metadata service on two VMs to allow token-based access only and show that legacy requests are refused.
- Find and protect an unauthenticated function endpoint: Find the function in Yakamoz Telekom's account that can be invoked without authentication, add authorisation and verify anonymous calls are refused.
- Find a leaked access key in a code repository: Scan the lab application repository with a secret scanner and record the leaked cloud key with its file and commit.
- Revoke a leaked key and issue a replacement: Revoke the key found, supply a new one to the application securely and verify calls with the old key are refused.
- Review and report the usage logs of a leaked key: Sift Erguvan Sigorta's audit logs for unexpected calls made with the leaked key, assess the impact and write the incident note.
- Find DNS records pointing at deleted cloud resources: Compare the lab zone's records with the resources in the account and list those pointing at resources that no longer exist.
- Clean up dangling cloud records and verify: Remove the two dangling records in Kuzeyyıldızı Kargo's zone and verify the subdomains can no longer be attached to another account.
- Audit the cloud external surface and write a closure plan: Combine storage, network, identity and DNS findings in Demirsu Enerji's lab account, prioritise them and prepare a closure plan with owners.
About this course
Starting from the shared-responsibility model you inventory the organisation’s cloud assets, then find and close public storage, overly wide security groups, shared disk images and leaked access keys.
What you will learn
- Visibility in the cloud
- Storage and network
- Services and identity
- Continuous auditing
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.