Welcome to Cloud Infrastructure Analysis with Scout Suite.
My name is Guillaume Ross, and in this course,
we're going to look at how you can security your cloud
infrastructure environment using Scout Suite.
Scout Suite is a tool that was created by NCC Group.
It's an open source, multi‑cloud security auditing tool,
which allows you to assess the security posture of cloud environments and
to produce reports highlighting risky configurations.
It's meant to be run as a point‑in‑time tool as it takes a snapshot of
the current security configuration of the environment,
making it ideal for consultants.
Scout Suite is a Python tool that you can execute from any system
able to connect to your cloud environments.
It can be downloaded on the following GitHub repo.
And not only is it open source, but it's very easy to use,
supports most cloud vendors,
and has multiple different security checks for those.
So if you're using AWS, GCP, Azure, or even Alibaba or Oracle Cloud,
Scout Suite's got you covered.
If we look at the NIST cybersecurity framework,
which is made out of five functions,
we could say that Scout Suite is mostly linked to two of them.
The first one would be identify because it lets you identify all
the cloud resources that you have and identify the configuration so
you can make sure that they're good.
But in reality, it's doing that to allow you to protect these cloud environments.
Many of the different checks in Scout Suite are around identity management,
authentication and access control, data security,
and protective technologies of those cloud vendors.
If we look at identity management as an example,
Scout Suite will help you make sure that you cover PR.AC‑3.
Remote access is managed by looking at all the different accounts
you have on your Amazon or GCP environment, for example. It'll
also let you fulfill PR.AC‑5, which is monitoring for unauthorized personnel,
connections, devices, and software.
It'll do that by making sure that all your logging
configuration is appropriate in your cloud environment.
If we looked at this tool with a mitre attack‑specific angle,
we'll see that it lets us analyze a very specific type of information,
which is data around your infrastructure through infrastructure analysis.
It'll help us prevent attacks using the following techniques from being
executed, things like T1078, valid accounts being exploited, or T1538, the
cloud service dashboard being used against your will.
It'll also make sure that you're not vulnerable to
T1530, data from cloud storage object.
For example, if you had a S3 bucket that was public and unencrypted,
it would tell you about that.
And then if we looked at some of the subtechniques,
then for valid accounts, we will specifically be looking at cloud accounts.
Scout Suite is pretty simple to use.
First of all, you need a client running it.
This could be your laptop.
It can be a virtual machine running Linux.
It could be pretty much anything,
even a Docker container. On that machine, you'll need the
credentials to read the configuration of your cloud environment.
And then, you'll configure the checks that you want to be
executed on the specific environment.
There are default checks for all cloud vendors,
and you can definitely start with that.
What Scout Suite is going to do is connect to those cloud environments.
It'll then retrieve the configuration and evaluate them against those
checks that are configured with the goal of producing a report where you
can see what configuration needs to be changed.
In this demo, we're going to use a Linux machine with Python 3.
You'll also need the Amazon CLI, as well as many other dependencies.
Don't worry about it though if you're missing anything. Scouts
Suite is really good at telling you what is missing so you can
just install it and then try again.
We're going to use SadCloud to generate a vulnerable AWS environment.
SadCloud is another tool made by NCC to voluntarily
create a vulnerable AWS environment.
Never use this against a real environment.
In fact, if you have a real environment to scan,
skip this section completely and go to the part where we're going to
configure a granular IAM policy for Scout Suite to be run. Again, do
not use SadCloud on a real environment.
Only use SadCloud if you're creating a brand new AWS
environment from scratch. Then we'll need to set up our
keys to this Amazon environment,
git clone Scout Suite, and then simply execute it.
And this command right here is going to run the default
checks for the Amazon Web Services provider.