Cloud security protects cloud-hosted infrastructure, services, data, identities, and workloads against unauthorized access and attacks. It treats security as an ongoing effort rather than a problem solved by one product, because threats, configurations, and cloud environments continually change. section 1.1
Common weaknesses and threats include:
- Misconfigured workloads, publicly exposed virtual machines, leaked credentials, and unencrypted secrets can create direct paths into an environment. section 1.1
- Attackers may use ransomware, brute-force attacks, supply-chain attacks, zero-day vulnerabilities, denial-of-service attacks, insider threats, or data theft. section 1.1
- A cloud attack can progress through exposure, access, lateral movement, actions on objective, and goal. section 1.5
An exposed VM and crypto-mining attack
A virtual machine with internet-accessible ports may invite username-and-password guessing. After compromise, attackers can deploy malware, move laterally across resource types, compromise a Kubernetes cluster, and deploy a malicious container image that runs a crypto miner and generates unexpected Azure costs. section 1.5
Figure 1.2 The kill chain model helps visualize the steps that bad actors may perform to compromise your Azure environment.
Use the kill chain model to trace how an exposed Azure resource can lead from initial exposure through access, lateral movement, and the attacker’s objective. section 1.5
