"Researchers Find New Approach to Attacking Cloud Infrastructure"

Igal Gofman, head of security research at XM Cyber, and Yaron Shani, XM senior security researcher, will demonstrate a new approach to attacking cloud infrastructure at the 2019 Black Hat Europe. In regard to the use of public cloud infrastructure by organizations, there is a lack of understanding about the cloud identity and access management layer, often leading to security failures such as misconfigurations that threaten customer privacy and security. Existing security practices and controls have been proven inadequate in the mitigation of risks presented by misunderstandings of the public cloud. Research conducted by Gofman and Shani revealed that many traditional defense mechanisms only address specific attacks vectors. In addition, these mechanisms are usually defensive, not predictive. The methodology developed by Gofman and Shani involves the use of a graph to help red and blue teams understand permission relationships between different entities in cloud environments. Further understanding of these connections would reveal how features can be abused by attackers to gain privileges. This article continues to discuss the common misunderstandings about cloud infrastructure, as well as popular defense mechanisms for the cloud and the new approach to attacking such infrastructure. 

Dark Reading reports "Researchers Find New Approach to Attacking Cloud Infrastructure"