Unit 02 of 02
Cloud Detection and Hardening
How much of the spread walk is visible and which control actually lowers the radius: the step that is visible and the step that is never visible in management plane logs, the step that continuous configuration posture management closes before deployment and the window left open by remediation delay, the radius of container and hypervisor escape in a multi-tenant environment, the window in seconds during which a log entry can be collected in ephemeral workloads, the item-path-log-control quartet of cloud attack patterns, and how collecting evidence in the cloud differs from a host image.
Published Updated
Lessons
- 01 Audit Logs Counting how much of the spread walk is visible in the log: in a 28-item graph, a single leaked identity reaches 23 items in 22 steps, and 11 of those steps land in a log entry the tenant can read; the first log entry drops at minute 9, by which point 8 items have been reached. Adding the data-read log entry raises the visible steps to 19, but the radius stays at 23; for the same cost of three legitimate jobs, automatic session cancellation brings the radius down to 22, and closing off role chaining brings it down to 18. 14 min read
- 02 Configuration Posture Management Measuring whether a misconfigured item closes before or after deployment: 13 of the graph's 23 edges are tied to a misconfigured item, 7 of those are in the template, 2 in acceptance, and 4 are only seen at runtime. The template gate lowers the radius from 23 to 8, the acceptance gate closes two more items and does not lower the radius at all, and the runtime scan alone lowers it to 4. In a one-week window, daily scanning with approved remediation leaves the radius open for 39 hours, hourly scanning for 25 hours, and automatic remediation for 2 hours; moving to continuous scanning gains 1 hour at the cost of 12 times the evaluations. 14 min read
- 03 Container and Hypervisor Security Measuring escape radius in a multi-tenant environment: with 18 workloads, three tenants, and six hosts, a container escape in a shared placement reaches 18 items in the worst case, spilling into another tenant in seven of eight workloads. Separating by tenant zeroes out cross-tenant escape while raising our own worst-case radius to 21; separating by identity leaves the worst case at 18, lowers the average from 12.5 to 8.5, and raises the host count from 6 to 13. Strengthening isolation raises the item count required to cross from 1 to 3, but does not lower the radius at all. 14 min read
- 04 Serverless Security Measuring the window in which evidence can be collected for short-lived workloads: the median lifetime of 400 calls is 447 ms; manual collection tied to an alert catches none of the 400 calls, automatic collection catches 15. Continuous streaming from within the environment takes 3,541 of 3,600 evidence items; a 60-second hold gives the same result at 34 times the running time in environment-seconds. The identity's validity period, meanwhile, is 8,054 times the lifetime, and one hundred percent of the open item-seconds pass after the workload has ended. 13 min read
- 05 Cloud Attack Patterns Counting thirteen patterns on the same graph with the item-step-log-control quadruple: eight of the patterns open with a step that falls into a management-plane log, three with a step that stays only at the provider, one with a step that falls into no log at all. The pattern with the largest contribution — the instance-bound identity being given without session verification — on its own raises the radius from 6 to 23, and it is in the unlogged class. The order of controls determines the cost: by unit benefit, one control and two cost; starting from cheapest, eight controls and eight cost reach the same radius. 14 min read
- 06 Cloud Differences in Incident Response Counting how collecting evidence in the cloud differs from a host image: of 20 evidence items, 16 are collectible on a host you manage yourself, and of these, 4 are not collectible on a managed instance, 11 on a container service, 14 in a function environment. Isolation can be done from four planes: the identity plane cuts at minute 11 and stops the radius at 13, preserving all five volatile evidence items, while terminating the instance gives the same radius by erasing all five volatile items. The snapshot carries 10 of the 16 items, and verification for all of them rests on the provider's attestation. 14 min read