In 2021, ERNW collaborated with
Hochschule Mannheim for their CEP (Cyber Security
Entwicklungsprojekt) to build an auditing framework for testing operating system
configurations against security procedures. This project is part of the
education program of the university to give the students the chance to utilize
the knowledge gained throughout the first semesters in a real world project.
ERNW posed as the fictitious customer, providing a requirements document and
regular meetings with all project groups for feedback. We planned to process and
adapt the results for an open source auditing framework. Unfortunately, we were
not able to finish this project yet, but we think the students should get some
attention for their work independent from our side. So here is a short summary
of what the students created and the corresponding repositories.
Related to our new TROOPERS workshop “Jump-Starting Public Cloud Security”, this post is going to describe some relevant components which need to be taken care of when constructing and auditing an Amazon Web Services (AWS) cloud environment. Those include amongst others the general AWS account structure, Identity and Access Management (IAM), Auditing and Logging (CloudTrail and CloudWatch), Virtual Private Cloud (VPC) networks, as well as S3 buckets.
The AWS IAM service is responsible for identity and access management (surprise!). This includes managing user accounts, defining password policies, and – most importantly – creating, defining, and assigning groups and roles.
I’m currently involved in a “Remote Access Security Assessment” and you might be wondering what exactly this means. Well, so did we. At least to some degree (btw: last year we provided some notes on types of security assessments here).
It happens quite often we’re brought into an organization to perform “a security assessment” of “some item” (“our network”, “that new procurement portal”, “the PKI” etc.). It happens as well the customer does not have a very clear idea of the way such an assessment should be carried out (telling us “you are the experts, you should know what to do”). Or the five people from the customer’s side present in the kick-off meeting have five different concepts (ok, four. as one of them only wants “to get that damned assessment done so we can finally go live”) and we end up moderating their arguments on what should be tested, how this should be done, when this is going to happen, which type of report format is needed (obviously, there’s different ones, depending on the goal/scope/methodology of the assessment…) etc.