{"id":102033,"date":"2019-09-20T06:00:26","date_gmt":"2019-09-20T13:00:26","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=102033"},"modified":"2019-09-19T13:49:21","modified_gmt":"2019-09-19T20:49:21","slug":"cloud-aws-critical-cloud-misconfigurations","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2019\/09\/cloud-aws-critical-cloud-misconfigurations\/","title":{"rendered":"Top 3 AWS Critical Cloud Misconfigurations and How to Remediate"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">By <\/span><span style=\"font-weight: 400;\">Nathaniel \"Q\" Quist, Sr. Threat Researcher, Public Cloud Security<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">It\u2019s no secret that cloud adoption yields tremendous business benefit \u2014 increased agility, reduced cost, flexibility, ease-of-use, the list goes on. The problem is, companies have adopted cloud faster than they\u2019ve been able to adopt security processes and practices to support it.\u00a0 Developer teams are enthusiastically spinning up cloud workloads and standing up new AWS infrastructure, while security teams may feel they are left to mop up.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Some of the major, headline-grabbing cloud breaches we saw over this past year reflect basic security configuration mistakes: allowing traffic to Port 22 from the public internet, leaving the remote desktop protocol (RDP) exposed. We wouldn\u2019t perform these actions within on-prem infrastructure, so why are we seeing this in cloud? A bird\u2019s eye view of what\u2019s going on would look much like a repeat of what we saw in the 90s: developers excitedly leveraging the newest technologies and acting with little to no thought about the security implications of their latest project.<\/span><\/p>\n<p><span style=\"font-weight: 400;\"><img loading=\"lazy\" decoding=\"async\"  class=\"alignleft size-medium wp-image-102078 lozad\"  data-src=\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/09\/Broken-Window-230x153.jpg\" alt=\"An image of a broken window highlights the risks of leaving the top three AWS critical cloud misconfigurations unremediated. \" width=\"230\" height=\"153\" srcset=\"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/09\/Broken-Window-230x153.jpg 230w, https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/09\/Broken-Window-768x512.jpg 768w, https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/09\/Broken-Window-500x333.jpg 500w, https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/09\/Broken-Window-450x300.jpg 450w, https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/09\/Broken-Window-60x40.jpg 60w, https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/09\/Broken-Window-400x268.jpg 400w, https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/09\/Broken-Window-874x583.jpg 874w\" sizes=\"auto, (max-width: 230px) 100vw, 230px\" \/>Novice configuration mistakes transform the cloud into a Wild West for hackers, full of gold mines of opportunity for them. This helps explain the rapid emergence of <\/span><a href=\"https:\/\/unit42.paloaltonetworks.com\/rockein-the-netflow\/\"><span style=\"font-weight: 400;\">cybercrime groups, like Rocke, that specialize in targeting the public cloud<\/span><\/a><span style=\"font-weight: 400;\">. The good news is, hackers are looking for easy money, so if you make it difficult for them by using proper configurations, they will look elsewhere.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">My team and I have spent the past few years collecting data from hundreds of cloud environments in order to learn about the biggest threats to the public cloud. We found that within the last year, 65% of attacks were due to misconfiguration. Our research has identified the top three critical misconfigurations that are most common in organizations\u2019 AWS environments. For each of these, following a set of simple recommendations will help organizations better secure their clouds and avoid becoming the next easy targets for attackers.<\/span><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><b>Security Group Allows Internet Traffic<\/b><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">A security group acts as a virtual firewall that controls the traffic from and to one or more instances. Security groups should have restrictive access control lists (ACLs) to allow only incoming traffic from specific IPs and to specific ports where the application is listening for connections. While the major three cloud service providers (CSPs) block all ingress traffic by default, they allow all egress traffic by default. It is highly recommended that security teams review all security groups on a regular basis to ensure they are properly configured and unwanted changes have not been applied. One of the checks that should be made is to make sure that your current security group policies only allow traffic to and from appropriate addresses, based upon the nature of your organization\u2019s requirements.<\/span><\/p>\n<p><b>Recommendations<\/b><\/p>\n<p><span style=\"font-weight: 400;\">If you find a security group allows all ingress traffic, to prevent this inbound action:<\/span><\/p>\n<ol>\n<li><span style=\"font-weight: 400;\"> Log in to the AWS console and navigate to the 'VPC' service.<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Click on the 'Security Group' link located on the left side of the screen.<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Click on the 'Inbound Rules' tab and remove any row with a source value containing \u20180.0.0.0\/0\u2019 or \u2018::\/0\u2019.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">If your organization, or a particular subnet, does not need to communicate with every country or system worldwide:<\/span><\/p>\n<ol>\n<li><span style=\"font-weight: 400;\"> Log in to the AWS console and navigate to the \u2018VPC\u2019 service.<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Click on the 'Security Group' specific to the alert.<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Click on 'Outbound Rules' and add a row with the correct protocol (e.g., TCP, UDP, ICMP) and IP address\/net range, which should only receive the appropriate network connections.<\/span><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ul>\n<li><b>AWS Security Groups Allow Internet Traffic to SSH Port (22)<\/b><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">AWS security groups that allow inbound traffic on SSH port (22) from the public internet significantly increase the risk to an organization\u2019s security landscape. Research has found that vulnerabilities contained within out-of-date SSH services are some of the most heavily targeted vulnerabilities for malicious actors. Unit 42 research has shown that 56% of organizations have at least one cloud-based SSH service exposed to the internet. Leaving this port open may allow a bad actor to compromise the SSH service itself, or brute force the service, and potentially gain access to your organization\u2019s cloud environment.<\/span><\/p>\n<p><b>Recommendation\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">If the security group needs to restrict SSH traffic:<\/span><\/p>\n<ol>\n<li><span style=\"font-weight: 400;\"> Log in to the AWS Console and navigate to the 'VPC' service.<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Select the 'Security Group' link and click on the 'Inbound Rule' tab.<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Remove any rule that has a 'Port Range' value which includes port 22.<\/span><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ul>\n<li><b>AWS Security Groups Allow Internet Traffic from the Internet to RDP Port 3389<\/b><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Security groups should not allow RDP port 3389 traffic from or to the public internet. Doing so may allow a bad actor to compromise the RDP application through the use of an exploit, or to brute force the application and potentially gain access to your organization\u2019s cloud environment.<\/span><\/p>\n<p><b>Recommendation<\/b><\/p>\n<p><span style=\"font-weight: 400;\">If the Security Groups are found to allow RDP port 3389 traffic:<\/span><\/p>\n<ol>\n<li><span style=\"font-weight: 400;\"> Log in to the AWS Console and navigate to the 'VPC' service.<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Select the 'Security Group' reported in the alert, and click on the 'Inbound Rule' tab.<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Remove any rule that has a 'Port Range' containing port 3389.<\/span><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><b>Removing easy targets<\/b><\/p>\n<p><span style=\"font-weight: 400;\">The bottom line: These are three policy violations you should aim to <\/span><i><span style=\"font-weight: 400;\">never <\/span><\/i><span style=\"font-weight: 400;\">see in your environment. To ensure success, you will want to <\/span><a href=\"https:\/\/www.paloaltonetworks.com\/cloud-security\/prisma-public-cloud\"><span style=\"font-weight: 400;\">automate guardrails<\/span><\/a><span style=\"font-weight: 400;\"> so that developers can continue to run freely in the cloud without compromising your organization\u2019s security.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">To learn more about our threat intelligence research on the public cloud, read the full <\/span><a href=\"https:\/\/start.paloaltonetworks.com\/unit-42-cloud-with-a-chance-of-entropy.html\"><span style=\"font-weight: 400;\">Unit 42 Cloud Research Report.<\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Simple recommendations will help organizations better secure their clouds by avoiding the top three critical misconfigurations in AWS environments.<\/p>\n","protected":false},"author":663,"featured_media":102078,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6768],"tags":[897,1166,586],"coauthors":[6850],"class_list":["post-102033","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-the-cloud","tag-aws","tag-cloud-security","tag-unit-42"],"jetpack_featured_media_url":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/09\/Broken-Window.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/102033","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/663"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=102033"}],"version-history":[{"count":5,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/102033\/revisions"}],"predecessor-version":[{"id":102091,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/102033\/revisions\/102091"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/102078"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=102033"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=102033"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=102033"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=102033"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}