Threat Stack is now F5 Distributed Cloud App Infrastructure Protection (AIP). Start using Distributed Cloud AIP with your team today.
As part of their 24/7 work supporting customers through the Cloud SecOps Program℠, the security analysts in the Threat Stack Security Operations Center (SOC) regularly investigate suspicious activity on behalf of our customers. Over the past several months, our security analysts have noticed a steady increase in the use of automation tools that include web-based SSH features.
The use of these tools is a concrete sign that many organizations are maturing their cloud environment and are becoming more sophisticated in their cloud orchestration and day-to-day management. By using web-based SSH and other features that can run custom scripts on remote servers, operations teams can drastically reduce overhead and streamline the lifecycle of their servers and the configuration of services at scale.
However, as we have seen in the past, automating complex operations can lead to mistakes or overlooked risks. First, ensuring that your IAM policies are up to date and specific down to the individual features of given services becomes even more critical. In addition to the focus on IAM, many automation tools, including ones with web-based SSH features, introduce unique challenges for security teams as they investigate suspicious activity in their cloud environment.
In Linux systems, web-based SSH tools don’t manifest as traditional SSH sessions in the underlying logs. This difference can lead to system events in logs that aren’t associated with any logged-in users. Normally, this looks like regular, trusted automation activity — but not if a user can issue arbitrary commands behind it. The implications here are pretty obvious: If a malicious actor, whether an insider or someone leveraging compromised credentials from the outside, is able to gain access to a web-based SSH tool, obfuscation becomes trivial.
The full stack security observability and behavioral analysis capabilities of tools like the Threat Stack Cloud Security Platform® are able to identify this suspicious activity, but this is where the automated nature of web-based SSH tools throws a curveball at security analysts. It requires a different investigative technique to recognize and pivot off nuances in automation events to uncover the underlying intent of a user.
That’s where the Threat Stack SOC analysts come in. By working directly with some of the industry’s most progresssive cloud environments, they are intimately familiar with how to investigate these types of incidents. If you want an inside look at how the Threat Stack Cloud SecOps Program analysts investigate the downstream actions of automation tools when conducting forensics that require user attribution, download our latest Threat Intelligence Report or register for our live demonstration — “Automated Activity or Insider Threat: Can You Tell the Difference?” — being held on March 19.
Threat Stack is now F5 Distributed Cloud App Infrastructure Protection (AIP). Start using Distributed Cloud AIP with your team today.
About the Author
Related Blog Posts
F5 accelerates and secures AI inference at scale with NVIDIA Cloud Partner reference architecture
F5’s inclusion within the NVIDIA Cloud Partner (NCP) reference architecture enables secure, high-performance AI infrastructure that scales efficiently to support advanced AI workloads.
F5 Silverline Mitigates Record-Breaking DDoS Attacks
Malicious attacks are increasing in scale and complexity, threatening to overwhelm and breach the internal resources of businesses globally. Often, these attacks combine high-volume traffic with stealthy, low-and-slow, application-targeted attack techniques, powered by either automated botnets or human-driven tools.
F5 Silverline: Our Data Centers are your Data Centers
Customers count on F5 Silverline Managed Security Services to secure their digital assets, and in order for us to deliver a highly dependable service at global scale we host our infrastructure in the most reliable and well-connected locations in the world. And when F5 needs reliable and well-connected locations, we turn to Equinix, a leading provider of digital infrastructure.
Volterra and the Power of the Distributed Cloud (Video)
How can organizations fully harness the power of multi-cloud and edge computing? VPs Mark Weiner and James Feger join the DevCentral team for a video discussion on how F5 and Volterra can help.
Phishing Attacks Soar 220% During COVID-19 Peak as Cybercriminal Opportunism Intensifies
David Warburton, author of the F5 Labs 2020 Phishing and Fraud Report, describes how fraudsters are adapting to the pandemic and maps out the trends ahead in this video, with summary comments.
The Internet of (Increasingly Scary) Things
There is a lot of FUD (Fear, Uncertainty, and Doubt) that gets attached to any emerging technology trend, particularly when it involves vast legions of consumers eager to participate. And while it’s easy enough to shrug off the paranoia that bots...