Netskope named a Leader in the 2024 Gartner® Magic Quadrant™ for Security Service Edge. Get the report

close
close
  • Why Netskope chevron

    Changing the way networking and security work together.

  • Our Customers chevron

    Netskope serves more than 3,000 customers worldwide including more than 25 of the Fortune 100

  • Our Partners chevron

    We partner with security leaders to help you secure your journey to the cloud.

Still Highest in Execution.
Still Furthest in Vision.

Learn why 2024 Gartner® Magic Quadrant™ named Netskope a Leader for Security Service Edge the third consecutive year.

Get the report
Netskope Named a Leader in the 2024 Gartner® Magic Quadrant™ for Security Service Edge graphic for menu
We help our customers to be Ready for Anything

See our customers
Woman smiling with glasses looking out window
Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn about Netskope Partners
Group of diverse young professionals smiling
Your Network of Tomorrow

Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.

Get the white paper
Your Network of Tomorrow
Introducing the Netskope One Platform

Netskope One is a cloud-native platform that offers converged security and networking services to enable your SASE and zero trust transformation.

Learn about Netskope One
Abstract with blue lighting
Embrace a Secure Access Service Edge (SASE) architecture

Netskope NewEdge is the world’s largest, highest-performing security private cloud and provides customers with unparalleled service coverage, performance and resilience.

Learn about NewEdge
NewEdge
Netskope Cloud Exchange

The Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.

Learn about Cloud Exchange
Netskope video
The platform of the future is Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview
Netskope video
Next Gen SASE Branch is hybrid — connected, secured, and automated

Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud offering, ushering in a fully modernized branch experience for the borderless enterprise.

Learn about Next Gen SASE Branch
People at the open space office
Designing a SASE Architecture For Dummies

Get your complimentary copy of the only guide to SASE design you’ll ever need.

Get the eBook
Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn about NewEdge
Lighted highway through mountainside switchbacks
Safely enable the use of generative AI applications with application access control, real-time user coaching, and best-in-class data protection.

Learn how we secure generative AI use
Safely Enable ChatGPT and Generative AI
Zero trust solutions for SSE and SASE deployments

Learn about Zero Trust
Boat driving through open sea
Netskope achieves FedRAMP High Authorization

Choose Netskope GovCloud to accelerate your agency’s transformation.

Learn about Netskope GovCloud
Netskope GovCloud
  • Resources chevron

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog chevron

    Learn how Netskope enables security and networking transformation through security service edge (SSE)

  • Events and Workshops chevron

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined chevron

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

On Patents, Trolls, and Innovation
In this episode host Emily Wearmouth chats with Suzanne Oliver, an intellectual property expert, and Krishna Narayanaswamy, co-founder and CTO of Netskope, about the world of patents.

Play the podcast
On Patents, Trolls, and Innovation
Latest Blogs

Read how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky
SASE Week 2023: Your SASE journey starts now!

Replay sessions from the fourth annual SASE Week.

Explore sessions
SASE Week 2023
What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn about Security Service Edge
Four-way roundabout
  • Company chevron

    We help you stay ahead of cloud, data, and network security challenges.

  • Leadership chevron

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Customer Solutions chevron

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Certification chevron

    Netskope training will help you become a cloud security expert.

Supporting sustainability through data security

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more
Supporting Sustainability Through Data Security
Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain
Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn about Professional Services
Netskope Professional Services
Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn about Training and Certifications
Group of young professionals working

A MITRE-based Analysis of a Cloud Attack

Jan 23 2020

When you look at the details surrounding attacks in the cloud, how easy is it for you to quickly determine what happened and how to prevent a similar attack in your own environment? Applying the MITRE Att&ck Cloud Matrix is a great resource to classify and understand cloud-based attacks.

In this post, we will revisit a previous blog post to demonstrate how MITRE’s new Cloud Matrix can be applied to help us analyze the threat and prevent it from happening in your environment. We’ll recount the scenario, which exposes data in a storage bucket hosted by the Google Cloud Platform (GCP). Then we will examine some mitigations provided by MITRE, and look at how we could implement these in GCP.

Summary of the Scenario

The original scenario was an attack in which I escalated my privileges to remove a security perimeter established around a storage bucket that was storing sensitive data. The security perimeter only allowed people to access the bucket if they were coming from the correct IP address range. Below is a diagram, along with the steps taken to complete the attack.

The attack followed these basic steps:

  1. A service account credential was accidentally exposed, which had OSLogin permissions (allows someone to SSH to virtual machines).
  2. Using the exposed credential, I SSHd into a publicly exposed virtual machine.

The virtual machine was running with the default service account for Google Compute Engine (which has too many permissions), and the scope associated was, “Allow full access to all Cloud APIs.”

  1. Using the default service account, I listed the other service accounts in that project.
  2. I located a service account that had admin permissions and activated that service account from the virtual machine. At that point, I had administrative privileges at the Organization level.
  3. Using the admin service account, I removed a VPC Security Perimeter.
  4. After removing the VPC Security Control Perimeter, I accessed the data in the storage bucket that was previously protected.

The attack’s impact was the exposure of sensitive data. 

Breaking Down the Att&ck

Below are the tactics, techniques, and mitigations found in MITRE’s Cloud Matrix matched with parts of the attack. The numbers match with the attack steps in the section above. The text in italics under the MITRE mitigation column was taken directly from MITRE’s Cloud Matrix.

Along with MITRE’s Techniques and Mitigations, I’ve added some specific mitigative steps to take for GCP.

Step 1

Description: A valid credential was found in source control that was publicly exposed.

Scan your source code for credentials, and then update any credentials found. This is not specific to GCP. However, the GCP service account credential is an RSA key, so you will need to be sure that your scans include private RSA keys.

Step 2

Description: A SSH connection was established from outside the organization to a virtual machine hosted by GCP using the exposed credential.

Only allow SSH authentication from allow listed IP addresses. This can be configured in GCP firewall rules.

Step 3 + 4

Description: The credentials of the publicly exposed virtual machine were used to assume another identity that has administrative privileges in GCP.

The publicly exposed workload had a service account with no scope limitations, so its full capabilities would be allowed. In this case, the full capabilities meant that the virtual machine’s identity could be used to enumerate and impersonate other service accounts in the same GCP project.

To prevent this, you would need to scan the compute instances in your environment and make sure the “scopes” are not set to ‘Allow All’ while using the default service account. More information about service accounts and scopes for the compute engine is available here.

In addition, an administrative service account with an Organization-level binding had been created in the same GCP project as a publicly exposed workload. To prevent this, there are two main steps you can take:

  1. Do not give service accounts administrative privileges. In addition, do not bind them at the Organization level.
  2. If you must give a service account some administrative privilege or a binding at the Organization level, create that service account in a private project. Any publicly exposed workloads should be in projects separated from administrative service accounts.

Step 5

Description: A cloud perimeter control was removed, which protected sensitive data in part of the GCP environment.

GCP does not currently allow using conditions in Identity and Access Management (IAM) policies, but it is available in beta, and may change. Much like AWS, the conditions may allow us to set permissions that will only work from certain IP addresses.  More information about it is available here.

Step 6

Description: Sensitive data was accessed from an IP address outside of the organization.

We did have a VPC service control perimeter, which disallowed access from outside IP addresses. However, the attack removed that control. The preventative steps in for the other techniques should prevent this from happening. However, we should also be alerted to the modification or removal of a VPC service control perimeter. In order to generate that type of alert, you must monitor the audit logs. More information on audit log monitoring is available here.

Conclusion

Without using the MITRE Att&ck Cloud Matrix, a common approach to this incident would be to make sure that no credentials are leaked like this in the future. However, as you can see from all of the content above, there are a number of other mitigations that should be considered as well.

Due to the abstract nature of the cloud, and the immense amount of services and configuration settings that could be deployed, it’s difficult to understand all the factors involved in an attack. The exercise of applying MITRE’s Att&ck Cloud Matrix, discovering possible mitigations in the matrix, and then mapping those mitigations to your specific environment should be something employed to maintain a strong security posture. This exercise will also help you understand and evaluate security tool features that are important for your own use cases as well.

author image
Colin Estep
Colin Estep has 16 years of experience in software, with 11 years focused on information security. He's currently a researcher at Netskope, where he focuses on security for AWS and GCP.

Stay informed!

Subscribe for the latest from the Netskope Blog