There’s a darkness encroaching upon your security perimeter and it isn’t your Internet of Things everything device. It’s the “cloudification” of everything about to fall on your lap as a security professional. With the advent of more and more services, new providers, and rules to the security game, who is to protect our data? And what happens when things go wrong? 

 

As technologists, we expect to continue to learn new things at a rapid rate. But what do we do when cloud providers are all writing their own protocols, authentication schemes, and security perimeters? The lack of a common set of security expectations results in a lot of vulnerabilities and operational failures. It results in customer confusion and implementation failures of the cloud. Right now, we are living in the “the Wild West” and the weak are the prey. Anything is fair game and customers of cloud services are the ones often hacked, but not always. 

 

This presentation details some of these gaps and one red-team approach to highlight vulnerabilities on a company’s perimeter and “edge”. The Oracle Cloud Offensive Security group routinely assesses Oracle Cloud’s public facing internet exposure. Specifically, these red team engagement helps identify and remediate exposure, such as vulnerable and misconfigured endpoints and helps flex the incident response and detections teams. At the outset of the talk, offensive groups will be ready to answer the age old question of “can we persist forever?” and “how many shells are too many?” There will be mock up of tools highlighted and an overview of common misconfigurations of cloud deployments.