Responding to attacks targeting Cloud Identity solutions

As organisations increasingly rely on cloud-based identity and access management (IAM) solutions for cloud and on premises infrastructure, they become susceptible to a growing array of sophisticated attacks targeting user credentials and access privileges. Incident response in this context requires a specialized approach that addresses the unique challenges of cloud environments and IAM systems. 

This presentation explores the critical steps involved in effectively responding to cloud-based identity attacks, from preparation and detection to containment, eradication, and recovery. We will delve into our frontline experiences and lessons learned while combating attacks on cloud-based identity solutions. Our focus will be on providers like AWS Identity Provider, Entra ID, and Okta.

Exploiting IAM Misconfigurations:​ Taking advantage of weaknesses in IAM configurations, such as overly permissive access policies, roles and shadow credentials.

Exploiting Trust Relationships:​Attackers may exploit weaknesses in the trust relationships between the IdP and service providers (SPs) to gain unauthorized access to resources. This could involve manipulating metadata, forging assertions, or exploiting vulnerabilities in the federation protocols.

Adding Rogue Domains:​ Attackers may attempt to add unauthorized domains to the federation, allowing them to gain access to resources through impersonation or by exploiting trust relationships with legitimate domains.

Exploiting multi-tenant applications:​ Attackers may target tenants that host multi-tenant applications to gain a foothold in the application and then attempt to move laterally to access data or resources belonging to other tenants.

MFA Bypass:​Leveraging vulnerabilities in MFA implementations, such as exploiting session tokens, weak factors, Application secrets, identity federations and misconfigured enforcements