EC-Council Certified Ethical Hacker (CEH) v12Cloud ComputingHard
A cloud security engineer is investigating a series of unauthorized data exfiltration attempts from an organization's cloud storage buckets. The logs indicate that the access attempts originated from a compromised EC2 instance within the same Virtual Private Cloud (VPC), but the instance itself was not directly exposed to the internet. The attacker leveraged a vulnerable web application on the EC2 instance to execute commands and then used the instance's IAM role to access the S3 buckets. What is the most effective countermeasure to prevent this specific type of lateral movement and data exfiltration?
- AEnabling VPC Flow Logs to monitor all network traffic within the VPC.
- BImplementing strong multi-factor authentication (MFA) for all user accounts.
- CApplying granular IAM policies to restrict the EC2 instance's S3 access to only necessary buckets and actions.
- DDeploying a Web Application Firewall (WAF) in front of the vulnerable web application.
Show answer & explanationAnswer & explanation
Correct answer: C. Applying granular IAM policies to restrict the EC2 instance's S3 access to only necessary buckets and actions.
While a WAF might prevent the initial compromise, the core issue allowing data exfiltration is the EC2 instance's overly permissive IAM role. Applying granular IAM policies enforces the principle of least privilege, directly preventing the compromised instance from accessing unauthorized S3 buckets, even if the instance itself is compromised.
Why the other options are wrong
- A. VPC Flow Logs are excellent for detection and forensics but do not prevent the attack in real-time.
- B. MFA is crucial for user accounts, but the attack leveraged an instance's IAM role, not a user's direct login.
- D. A WAF would help prevent the initial compromise of the web application, but if the instance is still compromised via another vector, or the WAF is bypassed, the overly permissive IAM role still allows exfiltration.
Cloud Lateral Movement Countermeasures
Security controls designed to restrict an attacker's ability to move within a compromised cloud environment and escalate privileges or access further resources.
- Granular IAM policies are critical.
- Network segmentation and micro-segmentation limit reach.
- Monitoring and alerting for anomalous activity are essential for detection.
Memory trick: Lock down every door, even inside the house. Don't trust the interior.