Minimizing AWS S3 bucket attack vectors at scale
Channel: BSidesDFW
Date: 2022-11-29

BSidesDFW 2022 Track 1 Session 8 - 05 Nov 2022

Minimizing AWS S3 bucket attack vectors at scale

AWS provides services and third-party solutions, such as AWS Macie and Trend Micro, that can help us secure our S3 buckets and associated components. Macie is a fully-managed data privacy and data security solution that provides customizable alerts and findings on sensitive data found in S3. The downside is that it does not: (1) Auto-remediate threats and misconfigured S3 buckets; nor (2) Inspect and quarantine malicious files (malware, ransomware, etc.); Therefore, the security engineer must figure out how to overcompensate for these missed features by scanning each file to determine whether it is malicious using CloudOne and by inspecting Macie's findings report. The key issue, however, is that the engineer would have to manually undertake remediation actions. In this talk, I will discuss the pre-existing gap and the open-source solution known as DataCop. I'll also break down the architecture of DataCop, which will consist of: (1) Utilized Services (AWS Macie, S3, Trend Micro Cloud One); (2) S3 Remediation Actions - entire process and flow; (3) IAM Considerations; and (4) Language and Development Kits. Following the architectural deep-dive, there will be more information on the value added to existing processes if this solution were to be adopted. To conclude, those who attend this talk will leave with practical knowledge on automating the remediation of S3 buckets on Macie's and Trend Micro Cloud One's findings.

@damienjburks
Damien Burks (he/him) is currently a Cloud Security Engineer - VP at Citi. Recently, he worked as a Security Software Engineer at Verizon as a supporting developer for the CSO 50 award-winning in-house DLP solution. Over the past three years of his career, he has obtained four AWS certifications with the AWS Security Specialty as the most recent. In addition, he is pursuing a Master's of Science in Cybersecurity Technology from UMGC. Outside of his career and education obligations, he is an avid writer/blogger, open-source contributor, and mentor to BIPOC LGBTQ+ tech professionals who wish to break into the tech industry. To decompress, Damien likes to play video games, modify his car, and attend local car meets within the DFW area.
www.damienjburks.com