Cloud Account

Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office

Network Segmentation: Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise.

Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like firewalls, routers, and cloud-based configurations. This mitigation can be implemented through the following measures:

Segment Critical Systems:

• Identify and group systems based on their function, sensitivity, and risk. Examples include payment systems, HR databases, production systems, and internet-facing servers.
• Use VLANs, firewalls, or routers to enforce logical separation.

Implement DMZ for Public-Facing Services:

• Host web servers, DNS servers, and email servers in a DMZ to limit their access to internal systems.
• Apply strict firewall rules to filter traffic between the DMZ and internal networks.

Use Cloud-Based Segmentation:

• In cloud environments, use VPCs, subnets, and security groups to isolate applications and enforce traffic rules.
• Apply AWS Transit Gateway or Azure VNet peering for controlled connectivity between cloud segments.

Apply Microsegmentation for Workloads:

• Use software-defined networking (SDN) tools to implement workload-level segmentation and prevent lateral movement.

Restrict Traffic with ACLs and Firewalls:

• Apply Access Control Lists (ACLs) to network devices to enforce "deny by default" policies.
• Use firewalls to restrict both north-south (external-internal) and east-west (internal-internal) traffic.

Monitor and Audit Segmented Networks:

• Regularly review firewall rules, ACLs, and segmentation policies.
• Monitor network flows for anomalies to ensure segmentation is effective.

Test Segmentation Effectiveness:

• Perform periodic penetration tests to verify that unauthorized access is blocked between network segments.

Multi-factor Authentication: Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include:

• Something you know: Passwords, PINs.
• Something you have: Physical tokens, smartphone authenticator apps.
• Something you are: Biometric data such as fingerprints, facial recognition, or retinal scans.

Implementing MFA across all critical systems and services ensures robust protection against account takeover and unauthorized access. This mitigation can be implemented through the following measures:

Identity and Access Management (IAM):

• Use IAM solutions like Azure Active Directory, Okta, or AWS IAM to enforce MFA policies for all user logins, especially for privileged roles.
• Enable conditional access policies to enforce MFA for risky sign-ins (e.g., unfamiliar devices, geolocations).
• Enable Conditional Access policies to only allow logins from trusted devices, such as those enrolled in Intune or joined via Hybrid/Entra.

Authentication Tools and Methods:

• Use authenticator applications such as Google Authenticator, Microsoft Authenticator, or Authy for time-based one-time passwords (TOTP).
• Deploy hardware-based tokens like YubiKey, RSA SecurID, or smart cards for additional security.
• Enforce biometric authentication for compatible devices and applications.

Secure Legacy Systems:

• Integrate MFA solutions with older systems using third-party tools like Duo Security or Thales SafeNet.
• Enable RADIUS/NPS servers to facilitate MFA for VPNs, RDP, and other network logins.

Monitoring and Alerting:

• Use SIEM tools to monitor failed MFA attempts, login anomalies, or brute-force attempts against MFA systems.
• Implement alerts for suspicious MFA activities, such as repeated failed codes or new device registrations.

Training and Policy Enforcement:

• Educate employees on the importance of MFA and secure authenticator usage.
• Enforce policies that require MFA on all critical systems, especially for remote access, privileged accounts, and cloud applications.

Privileged Account Management: Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures:

Account Permissions and Roles:

• Implement RBAC and least privilege principles to allocate permissions securely.
• Use tools like Active Directory Group Policies to enforce access restrictions.

Credential Security:

• Deploy password vaulting tools like CyberArk, HashiCorp Vault, or KeePass for secure storage and rotation of credentials.
• Enforce password policies for complexity, uniqueness, and expiration using tools like Microsoft Group Policy Objects (GPO).

Multi-Factor Authentication (MFA):

• Enforce MFA for all privileged accounts using Duo Security, Okta, or Microsoft Azure AD MFA.

Privileged Access Management (PAM):

• Use PAM solutions like CyberArk, BeyondTrust, or Thycotic to manage, monitor, and audit privileged access.

Auditing and Monitoring:

• Integrate activity monitoring into your SIEM (e.g., Splunk or QRadar) to detect and alert on anomalous privileged account usage.

Just-In-Time Access:

• Deploy JIT solutions like Azure Privileged Identity Management (PIM) or configure ephemeral roles in AWS and GCP to grant time-limited elevated permissions.

Tools for Implementation

Privileged Access Management (PAM):

• CyberArk, BeyondTrust, Thycotic, HashiCorp Vault.

Credential Management:

• Microsoft LAPS (Local Admin Password Solution), Password Safe, HashiCorp Vault, KeePass.

Multi-Factor Authentication:

• Duo Security, Okta, Microsoft Azure MFA, Google Authenticator.

Linux Privilege Management:

• sudo configuration, SELinux, AppArmor.

Just-In-Time Access:

• Azure Privileged Identity Management (PIM), AWS IAM Roles with session constraints, GCP Identity-Aware Proxy.