Unit 42 Cloud Threat Report: Identity Security

Defense in depth starts
with identity in the cloud

Cloud is now the dominant platform for enterprise application development. Based on data from the 2020 State of the Cloud Native Security Report, up to 64% of enterprise workloads will be in the cloud in just the next 24 months. As architectures shift to take full advantage of cloud native technologies, governing identity and access management (IAM) will become an even more critical component of cloud security. IAM policies across all cloud accounts must be constantly monitored and evaluated to determine the potential risk exposure to the business.

Palo Alto Networks Unit 42^® cloud threat researchers have undertaken major new research on IAM in an ongoing effort to assess the security posture of cloud technologies. This latest report details the current identity landscape, methods attackers use to silently perform reconnaissance as well as a look at common threat actors themselves.

Matthew Chiodi
Chief Security Officer, Public Cloud

Uncovering identity
flaws worth millions

During a Red Team exercise in the spring of 2020, Unit 42 researchers were able to compromise an AWS environment with thousands of workloads.

An "outside in" penetration, where Unit 42 researchers, posing as attackers, unauthorized and with no credentials, were able to gain access to internal resources through a misconfigured IAM trust policy.

An “inside up” style of attack, where Unit 42 researchers, posing as attackers, started with limited (non-administrative) access and escalated their privileges to include administrative access to the entire cloud environment.

Unit 42 researchers note that all misconfigurations found during the exercise were customer misconfigurations, not AWS platform security misconfigurations. AWS has tried its best to detect and alert users when an IAM trust policy is misconfigured. However, while IAM trust policies are secure by default, users can still override the policies and introduce insecure configurations. AWS also offers its free IAM Access Analyzer to help identify unintended access to resources and data that are shared with an external entity.

An ongoing look at cloud infrastructure threats

In addition to the latest findings on risks stemming from IAM misconfigurations, Unit 42 researchers present updates on cloud security trends – looking for clear indications of the overall security posture of cloud infrastructure.

Cryptojacking tool spotlight: an analysis of Kinsing Unit 42 researchers provide an analysis of the cryptojacking tool Kinsing with a detailed look at its worm-like capabilities and established use in cryptojacking operations around the world.

Cryptojacking continues to be a persistent threat for organizations Unit 42 research shows cryptojacking to affect at least 23% of cloud-enabled organizations globally. Cloud environments are being targeted, with a focus on malicious cryptomining (also known as cryptojacking) operations.