WEBVTT 00:00:00.640 --> 00:00:03.750 Welcome all to the Cloud Infrastructure Analysis Using Prowler. 00:00:04.440 --> 00:00:07.860 My name is Tim Coakley, and I'll be your instructor for this course. 00:00:08.640 --> 00:00:10.950 I'm really happy that you've chosen to take this course, 00:00:11.440 --> 00:00:14.560 so let's get started with some background information about Prowler. 00:00:15.340 --> 00:00:19.460 Prowler was originally created by Toni de la Fuente and has been actively 00:00:19.460 --> 00:00:24.360 maintained for several years and is publicly available on GitHub. Prowler 00:00:24.360 --> 00:00:28.530 complements your existing cloud security infrastructure by allowing you to 00:00:28.530 --> 00:00:32.820 automatically assess your current cloud configurations against non‑security 00:00:32.820 --> 00:00:34.260 benchmarks and checklists. 00:00:35.090 --> 00:00:38.860 The benefit of this is that the process is automated and capable of 00:00:38.860 --> 00:00:43.330 performing over 100 different checks and provides both user or machine 00:00:43.330 --> 00:00:47.990 readable reports. Prowler uses the command line to operate, and the commands 00:00:47.990 --> 00:00:50.560 to use are relatively simple and easy to learn. 00:00:51.400 --> 00:00:53.660 This tool can be used to assess a single cloud 00:00:53.660 --> 00:00:56.600 account in AWS or multiple accounts, 00:00:57.010 --> 00:00:59.500 making it scalable to the needs of any enterprise. 00:01:00.240 --> 00:01:03.920 It's currently available under the Apache 2 open source license 00:01:04.300 --> 00:01:06.750 and is freely available to download from GitHub. 00:01:08.040 --> 00:01:10.650 There are two main areas of interest when using Prowler. 00:01:11.130 --> 00:01:15.280 First is choosing the assessments that are appropriate to your requirements 00:01:15.940 --> 00:01:19.060 with over 100 different types of assessment checks available. 00:01:20.140 --> 00:01:20.980 If, for example, 00:01:20.980 --> 00:01:24.960 your organization uses the Center for Internet Security Framework, 00:01:25.540 --> 00:01:30.250 then selecting the AWS CIS Benchmarks is a good start for you. 00:01:31.540 --> 00:01:35.870 Secondly is the reporting. Prowler displays its results on screen and 00:01:35.870 --> 00:01:38.690 also has the ability to create savable reports. 00:01:39.340 --> 00:01:43.040 This is really useful for both distributing findings to different teams in 00:01:43.040 --> 00:01:50.020 your organization, and also to use for building automated processes. Before I 00:01:50.020 --> 00:01:54.230 cover the details of using Prowler and the technical commands, I would first 00:01:54.230 --> 00:01:56.350 like to cover cybersecurity frameworks. 00:01:56.740 --> 00:01:58.690 There are a number of frameworks available, 00:01:58.700 --> 00:02:01.090 and the choice is really up to your organization to 00:02:01.100 --> 00:02:02.950 decide which is the most appropriate. 00:02:03.340 --> 00:02:06.310 NIST is one such framework that has grown in popularity. 00:02:06.740 --> 00:02:10.360 NIST gives an organization the ability to manage the broad spectrum of 00:02:10.360 --> 00:02:14.400 elements that make up cybersecurity with the ultimate aim of reducing 00:02:14.400 --> 00:02:17.090 risk to your organization and its partners. 00:02:17.370 --> 00:02:20.670 The NIST Cybersecurity Framework provides a set of standards, 00:02:20.670 --> 00:02:23.340 guidelines, and best practice to achieve a level of 00:02:23.340 --> 00:02:25.250 improved cybersecurity maturity, 00:02:25.440 --> 00:02:28.510 which you can see here are distilled into identify, 00:02:28.640 --> 00:02:31.460 protect, detect, respond, and recover. 00:02:31.940 --> 00:02:34.810 Each area contains subcategories that are linked to 00:02:34.810 --> 00:02:38.500 specific activities an organization needs to perform to 00:02:38.500 --> 00:02:40.460 improve its cybersecurity maturity. 00:02:41.240 --> 00:02:44.430 Prowler is a technology that helps an organization with 00:02:44.430 --> 00:02:46.660 the category anomalies and events. 00:02:47.140 --> 00:02:49.700 We can further narrow down the subcategories that link this 00:02:49.700 --> 00:02:52.750 technology to specific technical activities. 00:02:53.940 --> 00:02:58.050 Prowler can detect threats and enable security professionals to analyze 00:02:58.050 --> 00:03:00.750 findings and understand the targets under attack. 00:03:02.340 --> 00:03:05.690 Prowler forms part of the event data and correlation process. 00:03:06.230 --> 00:03:10.060 The output from the tool can determine what impact malicious events may have. 00:03:10.500 --> 00:03:13.340 The output from Prowler can also help to determine 00:03:13.430 --> 00:03:15.560 suitable thresholds for security alerts. 00:03:16.140 --> 00:03:20.070 This can include the methods used, as well as a potential impact to 00:03:20.070 --> 00:03:23.250 inform the organization of future security strategies. 00:03:23.840 --> 00:03:27.070 This course will demonstrate how to use Prowler and link 00:03:27.070 --> 00:03:29.060 to the concepts being discussed here. 00:03:30.540 --> 00:03:33.970 We also have the MITRE ATT&CK, which provides different techniques a 00:03:33.970 --> 00:03:36.660 threat actor may use against your organization. 00:03:37.340 --> 00:03:38.080 In this course, 00:03:38.080 --> 00:03:42.730 we will look at cloud service discovery. We want to identify 00:03:42.860 --> 00:03:45.710 and know which services deployed in your cloud environment 00:03:45.890 --> 00:03:47.410 are routable to the internet. 00:03:47.610 --> 00:03:50.150 We are going to look at how to identify internet facing 00:03:50.150 --> 00:03:53.550 services and how common it is for potential attackers to 00:03:53.550 --> 00:03:55.780 conduct reconnaissance of your environment, 00:03:56.060 --> 00:03:58.260 potentially a precursor to an attack. 00:03:59.040 --> 00:04:00.420 With the prevalence of cloud, 00:04:00.720 --> 00:04:02.520 it's more important than ever to know what is 00:04:02.520 --> 00:04:04.560 deployed within your cloud environment. 00:04:05.040 --> 00:04:05.680 Finally, 00:04:05.690 --> 00:04:10.080 MITRE Shield is one framework that covers attack techniques and how you 00:04:10.080 --> 00:04:12.360 can defend your environments against the attacks. 00:04:12.940 --> 00:04:13.670 Using this, 00:04:13.670 --> 00:04:19.120 we can link the attack techniques with the methods of defense, such as DTE0014 00:04:19.130 --> 00:04:24.080 ‑ Decoy Network: Creating a target network with a set of target systems for 00:04:24.080 --> 00:04:27.440 the purpose of active defense. We will look at one method of building an 00:04:27.440 --> 00:04:31.560 isolated environment in the cloud that is internet facing and which could be 00:04:31.560 --> 00:04:33.360 deployed to identify attackers. 00:04:34.240 --> 00:04:36.760 Where does Prowler sit within your organization? 00:04:37.740 --> 00:04:40.860 The answer depends on your organization and its culture. 00:04:41.640 --> 00:04:44.530 Since the results of Prowler may identify cloud security 00:04:44.530 --> 00:04:48.030 misconfigurations, such as internet facing services, 00:04:48.740 --> 00:04:51.450 these results may generate high priority security 00:04:51.450 --> 00:04:55.270 incidents, as such may sit within the cloud account used 00:04:55.270 --> 00:04:57.950 exclusively by security operation teams. 00:04:58.940 --> 00:05:02.960 Prowler can be run on a regular basis manually by an analyst and the results 00:05:02.960 --> 00:05:07.610 reviewed on screen. Equally, Prowler can be scheduled to run automatically 00:05:07.610 --> 00:05:10.950 every day with the report saved to a central location. 00:05:11.340 --> 00:05:13.460 Whatever the configuration you decide, 00:05:13.840 --> 00:05:15.790 Prowler will need to have the necessary account 00:05:15.790 --> 00:05:18.120 privileges to your cloud environments. 00:05:18.540 --> 00:05:19.840 As you follow along, 00:05:20.040 --> 00:05:22.890 you will be able to take away the ability to detect internet 00:05:22.890 --> 00:05:26.260 facing services and why it's important to do so, 00:05:27.140 --> 00:05:30.110 including how persistent and opportunistic attackers can 00:05:30.110 --> 00:05:32.610 be when trying to find vulnerabilities, 00:05:32.620 --> 00:05:35.450 exploit, and gain access to cloud environments. 00:05:35.940 --> 00:05:38.570 Cloud infrastructure security is a challenging but 00:05:38.570 --> 00:05:40.910 exciting area for the security professional, 00:05:41.060 --> 00:05:43.940 and Prowler is one of many useful technologies that will 00:05:43.940 --> 00:05:45.980 help you to defend your organization. 00:05:46.210 --> 00:05:46.970 With that, 00:05:47.020 --> 00:05:50.140 let's get into Prowler and take that first step into 00:05:50.140 --> 00:05:51.750 securing your cloud environment.