start	end	text
11340	18100	All righty. Well, good morning, good afternoon, or good evening, wherever you guys may be today.
18620	26120	I am Jura. Stand with me. I've got Patrick. And we are here to talk with Sean Metcalf
26120	33900	about his talk, Hacking the Hybrid Cloud. We've both taken some time to watch this.
33900	39020	Hopefully you guys have too. I thought it was an excellent talk, incredibly comprehensive,
39020	45320	and did a great job of kind of giving everybody, even if you don't have a lot of knowledge about
45320	51860	Active Directory or the way that some of these deployments work, of kind of bringing you up to
51860	56900	speed. So if you are kind of joining and are looking for a talk to watch and you haven't
56900	62820	caught this one yet, make sure you go back and check that out. Sean, why don't you take a moment
62820	68580	to introduce yourself. Tell us where you are, how you kind of got into this, and how we got to where
68580	77180	we are today. Sure thing. I'm Sean Metcalf, Pyrotek3 on Twitter. Hello everyone. I've spoken at a few
77180	84560	DEF CONs in the past. I really enjoy the security research element of technology and IT. I've been
84560	89620	working with Active Directory since pretty much when it came out in the year 2000. First as
89620	96740	operations admin, engineer, designer, architect, what have you. And then pivoted pretty hard into
96740	103680	the security aspect in say 2003, 2004. But I'd say probably the interesting thing to me was looking
103680	109100	at the security aspects of these systems along the way. A lot of times you have people that are
109100	112740	administrators and engineers and they understand the security elements of it. They understand the
112740	118880	challenges, but they just don't necessarily have the backing to push in that direction. So certainly
118880	124560	for me, since I was coming up through the Microsoft area, I didn't feel like the security space or
124560	131020	InfoSec was really a space for me because I had worked with Microsoft Windows and most of the
131020	137000	security people in 2000 to 2010 and certainly beyond are like, oh, Microsoft Windows, that's a
137000	143000	toy OS. What do you know about security in that area? So after I had been working with
143000	149940	Active Directory for a long time and I started seeing these attacks go from hypothetical to
149940	153500	reality, I said, hey, there's really something here. And I started putting together some talks
153500	158980	to help people better understand Active Directory security. And then in 2017, I did a talk with
159500	165380	Taya about hacking the cloud and what that actually means. And at the time,
165380	170320	Taya was working on the Azure Red team. And so I learned a lot from Taya about
171040	177520	how these things interconnect. Certainly looked a lot at Azure AD and Office 365 at that time.
177520	184420	As I was continuing that journey, in the past year, I identified some issues or concerns that
184420	190260	I had with hybrid cloud. So these connection points between your on-prem Active Directory and
190260	198620	Azure AD or Office 365 or Azure and beyond. And certainly Dirk-Jan Milema, he did a great talk
198620	203360	last year at DEF CON and has been publishing some great information about doing just that
203880	209140	from a comprehensive attack perspective. So certainly the research of others have been
209140	213000	inspiring my research recently and things that I've been looking at.
214700	221240	Excellent. Sean, so I guess also just for starters, can you kind of like
222240	227600	explain in a nutshell what like the hybrid cloud... I think people kind of understand
227600	231380	the cloud and people understand on-prem. Can you kind of talk a little bit about
231380	236440	what you mean with the hybrid cloud? Sure thing. So it's good to have a good
236440	240180	definition or it's good to have a solid definition of what it actually is because,
240800	245940	like you said, it can be confusing. So for me, at least the definition I put together for this talk
245940	251340	is hybrid cloud is when you have on-premises infrastructure. So you have something like
251340	256840	Active Directory and then you have something in the cloud. It could be you've extended your
256840	263680	on-prem environment into cloud IaaS infrastructure as a service. So you're using the cloud sort of as
263680	268120	an extension of your data center. A lot of organizations are moving into the cloud and
268120	275320	using the Azure or AWS or even GCP as their data center now. So that's one part of it. Another part
275320	279300	of it is when you have all your on-prem infrastructure that's handling your typical
279300	283920	things like Active Directory logons, things like that. But then you have services that are up in
283920	289260	the cloud. So your SaaS side, so software as a service. You have things like Salesforce or you
289260	294560	have Workday or you have Office 365 or things along those lines where you have some connection
294560	301780	points. And so certainly from the Office 365 on-prem AD side, there's a connection point called
302320	306960	Azure Active Directory Connect. And there's some interesting things that have occurred with
306960	311960	that connection point between your on-prem and that cloud environment. I pointed out some back
311960	317140	in 2017, Dirk Jans published a whole bunch of information about that. Others like Adam
317140	321880	Chesters has identified some things where the additional connection points of what Microsoft's
321880	329460	been doing to simplify this authentication flow between on-prem and the cloud. And I think that's
329460	335600	really one of the things that I wanted to dive into as part of my talk was discussing the roles
335600	341060	and how they're typically over permission and also looking at this authentication flow that
341060	345880	gets very complicated. And that's why I closed out the talk with a bunch of different slides
345880	349820	where you have three different cloud environments and you have your on-prem environment and you're
349820	355940	working through the federation of it and how they all get interconnected in very interesting ways.
356040	360740	The IAM story there, the Identity Access Management story is very complicated when
360740	365360	you have multiple cloud environments. And it gets difficult to track what all these roles are.
365360	370940	And typically they get over permission just like they do on-prem. So the other thing I wanted to
370940	376320	establish as a narrative of my talk was that we have virtualization on-prem. We're using VMware
376320	382380	primarily, predominantly. And then there's also Hyper-V to some extent. And then in the cloud,
382380	389220	we have effectively virtualization writ large. Be it Amazon AWS, which started with Zen,
389220	395420	uses more of Amazon's Nitro now, to Azure leveraging a custom version Hyper-V core, to
395960	402400	GCP using Zen to straight up in their environment. So this concept of virtualization and the way that
402400	407680	you attack or could attack virtualization on-prem is very similar to how you can do so in the cloud.
407680	411560	And I think that was an important part of what I was talking about. And I even mentioned how you
412540	417780	could attack on-prem AD domain controllers, as well as those on-prem AD domain controllers
417780	422700	hosted in the cloud. So regardless of where they are, they're vulnerable. And then the attacks
422700	426680	across those different platforms can have some similarities, but also some pretty
426680	436980	significant differences. Excellent. Also, is there really any kind of difference or what
436980	441860	should people think about if they have their AD environment in Azure or if they have it as an
441860	449000	on-prem AD environment? Are there differences they should think about? Sure. So my friend and
449000	454540	colleague Demetrius, his first question is, do you trust the cloud? Because everything starts
454540	460520	with that trust. So we usually presume or assume that our customers trust the cloud because they
460520	465880	already have things in it. But we still ask the question that to what degree or to what level do
465880	471340	you trust the cloud? Because you have to have that trust. I have concerns certainly about placing
471340	475240	on-prem Active Directory domain controllers into cloud environments, IaaS environments,
475240	478840	regardless of what they are, because ultimately there's a significant amount of trust.
479560	484100	With the cloud provider. The other part of that is oftentimes you'll set up your IaaS environment,
484100	489900	AWS or Azure, where your server admins are the ones that manage that entire environment.
489980	494600	Well, your server admins who manage that environment can run commands potentially on
494600	500060	the domain controllers in those environments. So if an attacker can compromise one of those
500060	506560	server admin accounts, then they can compromise your on-prem AD. I walked through for the scene
506560	514640	of the talk with Amazon over Federation, a way that you can link your IAM role in AWS with your
514640	519300	on-prem AD group. And then you can have an on-prem regular user that's a member of that group
519300	524460	that gets compromised because he's a regular user. And then leverage that account in order to
524460	530300	compromise the domain controllers hosted in AWS, just because that one account was compromised.
530300	536240	It has that extended role access and privileges. And then because it's in the cloud, that can
536240	540200	roll right back again and compromise the full on-prem Active Directory environment.
540620	545240	So there's some very interesting things that happen with that. So I also talk about one
545240	550820	interesting one from Azure AD to Azure, because of this sort of backdoor that Microsoft put into it
550820	555860	and has talked about, but it wasn't clear that if you were a global admin in Azure Active Directory,
555860	559700	that you could then go jump over to Azure and have full control of that environment.
559760	564360	So I walked through that as well, because these sort of connection points are interesting, but
564660	568060	a lot of times operations is like, let's go, let's get it done.
568320	573240	And they're being told by the executives, we have to get into the cloud. Our number one goal right
573240	578800	now is to get in the cloud. I mean, we've had a surge of interest and companies that have moved
578800	582760	to the cloud. We've been very busy talking and consulting with customers that are moving to
582760	586740	the cloud, because they're like, are we doing this right? Because operations gets pulled along
586740	591460	and thrown in and say, you got to migrate all these systems in the cloud. And then you have
591460	596140	security team going, I just don't know what I'm supposed to do with this. Like,
596140	601820	what are we supposed to know? Because the thing is on-premise is well understood, right? We at
601820	606740	least know what our egress ingress points are. At least we hope that they do. Pen testers and
606740	611760	red keepers are good at helping to point out what those actually are. We have a decent idea of
611760	615820	auditing and logging. And while things aren't great, at least there's some knowledge of where
615820	621160	some of those weaker points are. In the cloud, we have to leverage whatever the cloud provider
621720	627280	gives to us. So Azure, AWS, GCP, they have different capabilities. They have different
627280	632580	controls. And then the nomenclature, the names for all these things are different across all of them.
632580	638080	So one thing that may be called something in Azure, it may be called something different in
638080	644580	AWS and something else in GCP. So what I find myself doing is saying, okay, a subnet, whatever
644580	648920	that may be called in this cloud environment, that's what you need to do. Or let's have a zone
648920	655380	where we segment off this one type of system from the others. And then we make sure that we can
655380	660820	track and control what systems that can connect with it. I will say that one of the things that
660820	665420	we have the opportunity with in the cloud now is the ability to actually implement network
665420	670620	segmentation, which we've failed for years on prem, right? Because now we're setting everything
670620	675780	up. We should be building these zones. A zone for domain controllers, a zone for servers,
675860	680340	a zone for clients, a zone for other things, and then control the communication between them.
681120	685880	There's some ways that that could be done on prem, but the cloud gives the capability and
685880	694300	ability now to move forward in that direction. Cool. We've got some coming in from chat here.
694720	703080	So Mugs asks, Azure services evolve quickly. Do you see AAD evolving rapidly, or is it pretty
703080	708860	well baked at this point as a fundamental underpinning of PaaS and software as a service
709540	715620	services, generally speaking? Right. So Azure Active Directory and the Office 365 cloud,
715620	720920	that's kind of an extension of that, is evolving very rapidly. Microsoft keeps hiring developers
720920	727060	and adding new features. And it's funny because Mark Morrow, who I did a talk with
727060	731620	about the cloud last year at Black Hat, I was at Redmond with him earlier this year
731620	737440	for an Azure AD identity event. And as Microsoft was talking about some of the new features,
737440	741120	I looked over at him, I was like, yeah, so like Active Directory, right? He's not in his head.
741120	746680	So I think there's going to be some more and more parity between the Azure AD side and the AD side,
746680	752320	even though Azure AD is not Active Directory, at least not the same, because the authentication
752320	756580	is very different, the management is very different. But when you look at the way that
756580	763000	the features are being deployed and configured, MFA is getting baked into it. Conditional access
763000	767800	I consider is kind of an identity-based firewall. You can control who can access from where
767800	774740	with what sort of credentials, be it MFA or passwordless. So you have some of that control
774740	779820	capability baked into it. So I see it just growing. And the challenge is that the cloud
779820	786000	changes so frequently. I mean, myself trying to keep up with it, it's a lot. I mean,
786000	790920	Microsoft sends out emails to Office 365 customers, I think every week, saying these
790920	795400	are the new features. Azure Active Directory is growing and developing, maturing, and will
795400	802040	continue to. I think on the IaaS side, so Azure, AWS, GCP, I think pretty much the platform is
802040	806880	relatively stable from the perspective of hosting virtual machines, instances, whatever you want
806880	812960	to call them. And the management of those will grow and develop. And the orchestration around
812960	818040	that will grow and develop. The IAM, the ability to manage them will grow and develop. But I think
818040	823900	the core hosting components are pretty static. I think that the security elements and controls
823900	831580	will grow and develop and improve in that area as well. Excellent. So with regard to security
831580	839900	or hardening, R0 wants to know, what's the best AD sync scenario direction for hybrid environments?
839900	846800	Is it Azure to on-prem or on-prem to Azure? Or does it not matter? So typically, you're going
846800	853540	to have your on-prem environment sync to a cloud environment. And last year, I identified that there
853540	859920	were a lot of these sync tools. There's a different sync engine for just about every platform.
859920	867000	I mentioned Azure AD Connect for the Microsoft Azure AD Office 365 component. But oftentimes,
867000	870640	it's going to go that way because your core identity is going to be rooted in Active Directory
870640	875960	on-prem, at least for most organizations. As organizations would go more cloud first,
875960	882860	the challenge is that I've heard customers say, well, we're going to migrate from AD to Azure AD.
882860	888400	And I'm like, it just doesn't work that way. So you don't have LDAP. You don't have Kerberos. You
888400	894260	don't have NTLM for authentication. You don't have group policy. So everything's very different. So
894260	898560	it's not going to work the same way. And there's different controls and capabilities there. So
898560	903400	the identity is basically still going to be rooted in your on-prem AD unless you go with a
903400	910360	large federation provider that then becomes your identity provider, your IDP for that
910360	915000	identity for your users. At that point, then there's some other things you could do. But I
915000	918600	think for the most part, we're going to see on-prem AD, at least for the next few years,
918600	926040	syncing up to the cloud or some sort of weird amalgamation of combined identities. For years,
926040	930500	there was this concept of like a metaverse sync engine where you have different identities in
930500	936800	different places. You may have employees in your on-prem HR system, and you may have
937320	941960	contractors in some other system. And then you have this kind of collected understanding of
941960	947040	identity across those. I think that with federation, that gets simpler. And yet with the cloud,
947040	952500	it gets more complex because the identities need to be managed even more so now. And it's already
952500	958000	been talked about several times about how identity is the new vulnerability or the new attack surface
958000	964500	for organizations. Because we've seen that when an admin identity gets compromised, then the
964500	968520	whole environment can get compromised. And in the cloud, that gets even more complicated because
969040	974020	you don't necessarily know what users on-prem could be mapped to other things in a cloud
974020	978100	environment as far as what rights they have there. You can check them out in AD, and they're a member
978100	981840	of the right groups, and they can do all these other things, but they may be configured as an
981840	986580	admin in Workday or an admin in Salesforce. And that's not going to be clear. Of course, the same
986580	991900	thing can be true for, we're said, for VMware on-prem or another application. But it just...
991900	996140	that problem just gets exacerbated, so to speak, into the cloud environment as well.
1000600	1006660	I'm curious, what do you think, for an organization that is
1006660	1013200	kind of maybe thinking about moving towards more of a cloud strategy, do you think that,
1013200	1016500	because like you said, you've got upper management kind of saying, hey, this is what
1016500	1020040	we've got to do. We've got to move to the cloud, wave our hands around, say move to the cloud.
1021100	1026040	Is that kind of move towards the cloud in any of these kind of different scenarios, do you
1026040	1030900	that kind of move from a strictly security perspective? Is that more risky to do that
1030900	1035840	than sticking with on-prem? And how much more risky do you think people are taking on by doing that?
1036340	1042140	I think it's a balancing act, honestly, and it's a tough one. So the issue is that when
1042840	1047640	this train, this cloud train is moving and operations and security in an organization
1047640	1053600	just kind of has to get in line and just get on board with the cloud train,
1053600	1058760	the challenge is that there's a knowledge gap. And with the cloud, there's a huge learning curve.
1058760	1062440	I've certainly seen it. I'm sure others have. First of all, you can't just download some
1062440	1070980	software or trial and run it on a VM on your existing system. You can get a trial for 30 days,
1070980	1074420	but very often you're not going to learn what you need to. You're not going to learn what you
1074420	1079000	need to in 30 days on a trial. So it's going to cost some money. And then you have to find the
1079000	1083700	time to work with this new paradigm of an environment, whatever they may be. So there
1083700	1091040	are some pretty big barriers for entry as far as I'm concerned with it. And so the challenges with
1091040	1095080	the security of the cloud is you have to kind of understand the security capabilities of that cloud
1095080	1100380	environment. The other thing I mentioned in the talk is that we've talked to a customer where
1100380	1105220	their executive didn't want to have all their eggs in one basket. So they signed up with
1105900	1111220	all of the big three cloud providers, Amazon, AWS, Microsoft Azure, and Google Cloud Platform.
1111240	1116120	Now their eggs are in all the baskets. And it's even more challenging from that perspective,
1116120	1120240	because operations and security, they've got to figure out what that looks like and how to
1120240	1127740	normalize across all three. And of course there's programs or applications or systems that will help
1127740	1132240	you kind of merge all that together in a way that makes sense. But then you have one system that
1132240	1137800	overarches and controls or has control over all of these. So I think it's a complicated issue.
1137800	1142420	I think that certainly there are a lot of security benefits that can be gained from the cloud,
1142420	1145760	but you have to know what you're doing and know how to do it right. I mean, if you're going into
1145760	1151000	Office 365 and Azure AD, you could absolutely, as a relatively new company or relatively small
1151000	1155840	company, go cloud only and not have the on-prem AD, assuming that you don't have all the applications
1155840	1160880	that are tied into it. I did an Active Directory security assessment in the last year where they
1160880	1165920	had one Active Directory forest that had to stay around because the application they needed for
1165920	1171940	whatever they were doing that was in that forest, it was hard-coded to the name of the Active
1171940	1176100	Directory forest. And that application, the company that made it isn't around anymore. This is
1176100	1180880	10, 15 years old. So there's no way that they can move off that environment until they can figure
1180880	1185980	out how to have someone else come in and recode that application potentially. But there's
1185980	1190260	some weird scenarios like this that are challenges, but ultimately the migration from on-prem to the
1190260	1195060	cloud, I think the challenges that are going to be applications and authentication flow.
1195060	1201160	Some of the applications aren't going to support federation. I've told customers, look,
1201160	1205380	telecontracting now, any new applications have to support federation because this is the time to
1205380	1209640	actually get those onboarded. So that way you're not in a situation 10 years from now where you
1209640	1217440	can't move things. Now, as I said, the managed AD for the major cloud providers, Azure, AWS, GCP,
1217440	1223400	those are there to support those applications. But as I discussed in the talk, there's some
1223400	1227580	interesting things there because now you're providing an AD environment managed by the
1227580	1233160	cloud provider, but you're giving the application owner effectively the admin rights to that
1233160	1238000	environment. And they're not going to be as cognizant of how well to protect those credentials
1238000	1242600	potentially as someone else may be. So there's some interesting things with the managed AD
1242600	1247860	environments as well from a security perspective. So I say the, my answer is it's complicated,
1248200	1253860	but I think eventually it hopefully will get less complicated and be easier to actually
1253860	1259200	onboard these security tools like Microsoft security defaults for Office 365, which are
1259200	1263940	enabled or turned on by default now, once you have a new tenant.
1264960	1270140	What do you, having given that you've now kind of taken a big picture look at all of the different
1270140	1277120	platform options there, do you, is there one that kind of sticks out to you as one platform is doing
1277120	1283720	it better than the others? I'd say from a managed AD environment, and I looked at Azure AD domain
1283720	1291760	services, Microsoft managed AD in 2017. I looked at Amazon AWS as well in 2017. I like the fact
1291760	1297660	that Amazon AWS had all the different delegation groups that they have had. The initial goals of
1297660	1301420	those two environments were quite different. So that explained why they were, they were
1301420	1306800	configured that way. There's some interesting aspects around Amazon or Azure Active Directory
1306800	1311740	domain services, Microsoft's managed AD and how they sync, which could be some interesting things
1311740	1316860	for pen testers or red teamers. I would say that there's, there's certainly elements of each that
1316860	1322780	I like. I like how Amazon has delegated a lot of different things. I like GCP's approach to some
1322780	1326960	of the delegation that they're doing as far as just saying, okay, we're just going to give you
1326960	1335880	access to this component. For example, Azure ADDS and Amazon AWS both pre-create a fine-grained
1335880	1340160	password policy and say, here, you have rights to modify this. GCP is just like, go ahead and
1340160	1344140	create as many as you want, you know, kind of do your own thing. So there's definitely things I
1344140	1350380	like about them, the different ones. But I'd say probably Amazon AWS is probably a little more
1350380	1355420	mature from, from the delegation perspective and, and the, you can set this up and, and create a
1355740	1360240	from your on-prem to, to this managed AD environment and leverage this as an extension
1360240	1368900	of your on-prem AD. I was going to combine two of the questions that we got here, Gers,
1368900	1376820	from both Mugs and CrunchBank. How much better off are we if we don't sync credentials from the
1376820	1382700	on-prem to the cloud platform and rely on SSO? And if you're unwilling to do that,
1382700	1386620	what would you be missing out on using something like the ADPTA?
1387680	1393740	Good question. So the question really comes down to authentication and the risk profile of the
1393740	1399500	customer themselves. So for your single sign on from your on-prem to your cloud, it's typically
1399500	1403800	going to be federation, but that means you're going to have to manage and maintain your own
1403800	1408080	ADFS servers, your Microsoft Active Directory Federation servers, which are a pain. They are
1408080	1412140	not that easy to set up. It's, it's difficult to get right, get right. There's a lot of different
1412140	1416780	things you need to get correct. So then you're looking at Ping or Okta or one of those companies
1416780	1421480	that simplify that process for you, which is going to cost money. If you're a smaller company,
1421480	1424340	you're probably going to do something like password hash sync, at least to the Microsoft
1424340	1429340	platform where you're going to, it's Azure AD Connect is going to have the permissions and AD
1429340	1434320	to pull the hashes for all the different users that are synced. Go ahead and hash those and
1434320	1440120	send them up to Azure AD. And then when the user logs into Azure AD, it compares the password that
1440120	1446540	the user has typed to the hash function that it runs through the on-prem AD hash function, plus
1446540	1451680	the Azure AD hash function to see what that password actually is. The benefit of this password
1451680	1458180	hash sync is that Microsoft gets a ton of password data from security researchers privately, law
1458180	1463380	enforcement, dark web, stuff like that. So at least if you're doing password hash sync, you have a
1463380	1469000	pretty good chance of knowing if that credential has been compromised. So that, that is a nice
1469000	1473220	benefit. And if there's any sort of problem where like ransomware just crushes your on-prem AD
1473220	1477920	and your users can't authenticate, you can flip a bit and the users can authenticate directly to
1477920	1482200	Azure AD. So that way, at least they still have access to their collaboration environment.
1482580	1487340	So a couple of nice benefits there. PTA is interesting from the perspective of providing
1487340	1493340	access without having to do password hash sync or federation. I think that ultimately
1493340	1496940	password hash sync is probably the direction that everything's going to be going in.
1498080	1503580	There's certainly concerns, as I've highlighted, that other people have identified with the
1503580	1508160	different options. Like I said, federation's hard and a federation server has to be available to the
1508160	1513920	internet. So you have a federation server that's basically a web server that's listening to requests
1513920	1518360	from the internet. We have customers that have been had denial of service attacks, basically,
1518360	1522980	because accounts have been locked out with older versions of AD FS. So there's some challenges
1522980	1529560	there. You got to get up to AD FS on server 2019 to enable smart lockout and really have that
1530100	1535480	protect against this denial of service accounts are locked out. So I think it's definitely a
1535480	1540700	complicated story and it's going to be per organization. I'd say the larger organizations
1540700	1546480	pretty much already have federation because they have SaaS apps that they're using. And they pretty
1546480	1550960	well understand that the smaller organizations are going to use password hash sync or PTA.
1551400	1557500	Cool, I'm going to kind of combine maybe a little bit of a look forward along with with a fairly
1557500	1565140	good question that we got from chat. You mentioned in your talk that, you know, cloud is in cloud
1565140	1571100	security is a large area, it's growing area, and it's an opportunity for people that that are in
1571100	1576880	security or looking to further specialize to see some success over the next few years. I think that
1576880	1580440	the challenge for that is how do you how do you get in there? And how do you mess around with this
1580440	1586480	stuff? How do you learn this kind of thing? Specifically, you've been asked if you're going
1586480	1592720	to set up a hybrid training lab for red teamers of some kind. But you know, beyond maybe that,
1592720	1598020	you know, if someone wanted to learn this in their spare time on the side, what's the best way for
1598020	1604420	them to get into this kind of stuff? I would say that the best way to get into it would be
1604980	1610700	to use a trial. I mean, that'll get you 30 days of experience, I would say read the documentation.
1611900	1615700	There's videos out there as well, we're kind of walking through new features, that's a good way
1615700	1620500	to learn and understand what's there. For me, there's nothing better than actually doing and
1620500	1625080	playing around with it. I mean, for speaking specifically to Azure Active Directory and
1625080	1633080	Office 365, you can get an account for about $20 a month, I think, that gives you Office 365,
1633080	1639200	but they have cheaper ones than that, I think that you can use. But again, that is a barrier
1639200	1644000	to entry, because there's a cost with the cloud, that's not there for a lot of the on-prem things.
1644480	1648820	So you can, there's different trials that you can sign up for. So you could have one account
1648820	1654620	that might be $8 or $10 a month, and then kind of have trials for the others. And from what I've
1654620	1658900	seen with some of my testing, you can create a bunch of different accounts, and then have those
1658900	1664880	kind of last for a period of time, a short period of time, before they kind of just get pulled out
1664880	1672640	because they're not subscribed. So it is a challenge. I would say that every organization
1672640	1678380	should have a test account. And if your job is dealing with the cloud in any way, shape, or form,
1678380	1681960	ask your company to make sure there's a test account so you can better understand this,
1681960	1685440	because if you're going in this direction, company's going in this direction, the most
1685440	1689540	important thing they can do is to make sure that the operation security people understand the
1689540	1694640	elements and ramifications of this. The cloud to me is the wild west. We just have not explored
1694640	1700040	enough of it and gotten to the point where we truly understand it. We're not testing it as well
1700040	1704120	from a security perspective, from a red team pen test perspective. And I think from the security
1704120	1708300	perspective, I don't think the controls have been configured the way that they should be
1708300	1712500	for most organizations, just because there's a lack of understanding. New things come out,
1712500	1715000	new features are there, and they just don't get implemented.
1716000	1721180	So given that, if you can't mitigate the risk technically and practically,
1721940	1725720	here comes the lawyer to solve problems with lawyers and contracts.
1726580	1733500	What kinds of things do you think that somebody could build into an SLA to protect the client
1733500	1738740	in case you've got a compromise at the cloud service provider level?
1740860	1746340	That's a great question. I'm not sure. That's probably above my head as far as what that would
1746340	1752980	look like. And there's mitigations for that sort of thing. I mean, certainly from the IaaS side,
1752980	1757640	Amazon AWS has some components around how you can configure your own encryption key. That would
1757640	1763280	mitigate that pretty strongly, I would think. I believe GCP has the same capability. Azure
1763280	1768100	probably has the same capability as well. So there are some options there. Encryption is easy.
1768100	1771640	Key management is hard. So if you're managing your own keys, that makes things a little more
1771640	1776640	difficult. But I think that those are some mitigations that could be done. There are
1776640	1781580	certainly regulatory requirements based on things. But the thing is that these cloud providers have
1781580	1788960	all said, we meet all these criteria. So it does make it challenging. I don't have a good answer
1788960	1795360	for that. The cloud providers compromise at a pretty major level, which probably will happen
1795360	1799400	at some point. I don't know that it'll be the big three, because they spend a tremendous amount of
1799400	1803700	money on security. But a cloud provider compromise, I think, is going to happen at some point. It's
1803700	1808220	just the nature of what we do, like the Intel processors were compromised, which I think is
1808220	1813220	interesting in the past few years. So when you have hypervisors that are kind of the core to
1813220	1817240	what you're doing, and then people are going to look at the hypervisors, which they have.
1817800	1823700	And I think that's why Microsoft has something like $100,000 or $200,000 bug bounty for Azure
1824250	1826100	core hypervisor bugs.
1828160	1832780	Cool. I think there's kind of one last question. This kind of relates to how some of this stuff
1832780	1840520	operates out of the box, right? Do any of these cloud services that you have taken a look at
1840520	1846000	meet any of the kind of HIPAA requirements out of the box when it comes to using Active Directory
1846000	1852000	creds to try to link those together with any electronic medical records programs that you know?
1852860	1859380	So I don't look at the regulations per se. So I can't speak to that or really how they work
1859380	1866500	across the different cloud providers. I can tell you that the regulations, there's always the
1866500	1870520	regulation of how something's supposed to be because it's generally understood, that's the
1870520	1875460	best way to do it. Based on Active Directory security systems that I've done on-prem and what
1875460	1883180	I've seen customers do, which have been HIPAA compliant or PCI compliant, when you have a
1883180	1887900	domain in an Active Directory force, which is a PCI domain, and then you firewall that off, but
1887900	1891640	I can compromise a domain controller in one domain to jump over to a domain controller in
1891640	1897300	that other domain, then that breaks the whole concept of PCI for that. So these things have
1897300	1902860	to be separated. The security controls have to be better understood from the reality of it. And
1902860	1906720	that's why pentesting and red teaming, I think, is important. And certainly security assessments
1906720	1911440	like what we do, but the pentesting and red teaming, showing what these issues are and
1911440	1918940	walking through how they could be compromised despite controls that people academically think
1918940	1925120	are good, I think that's a big part of it. And I think that any aspiring or junior pentester or
1925120	1928900	red teamer watching this right now should absolutely start learning the cloud as best they
1928900	1934000	can. I mean, again, with the constraints of what it costs, but there's a lot of documentation out
1934000	1938720	there, especially from Microsoft. And there's videos about walking through what these features
1938720	1944300	are and what they do, and then start figuring out some ideas and some hypothesis of what this
1944300	1950460	might mean, and then spin up an environment and see what it looks like in a trial and play around
1950460	1954040	with it. And then your trial is going to expire and then give it a couple more months, set up
1954040	1958360	another trial to play around with it. And hopefully the cloud providers will provide some sort of
1958360	1963960	student or beginner access where they can actually just start playing around with these
1963960	1967560	things and get a better understanding of it. I'm sure that there's some learning programs that I'm
1967560	1973780	not aware of that someone will say afterwards, but that would be very helpful. Cool. Well, hey,
1973780	1979120	we are just about out of time, but I want to thank you for putting together your talk and
1979120	1984180	doing it pre-recorded, which I know is definitely a different experience than most of us are
1984180	1988520	used to kind of getting up there and doing it live, but then also kind of playing around with
1988520	1993580	this, with our kind of experiment of doing the live Q&A. I know I had a good time watching your
1993580	2000580	talk. I thought it was great. And I hope everybody in the chat thought the same thing. If anybody
2000580	2005640	needs to get ahold of you or, you know, kind of follow you for more of your developments,
2005640	2013280	where can folks find you on the internet? Twitter's the best, at Pyrotek3, that's P-Y-R-O-T-E-K,
2013280	2021720	number three. Good stuff. Well, thank you very much again, and everybody, everybody hanging out
2021720	2025960	in chat, you know, we're going to take a 30-minute break so you can watch the next talk if you
2025960	2032180	haven't watched it yet, and we'll have a new crew of goons and the next speaker up here in just a
2032180	2035760	little bit. Thanks a bunch. We'll talk to everybody soon. Thank you.