Welcome all to the Cloud Infrastructure Analysis Using Prowler.
My name is Tim Coakley, and I'll be your instructor for this course.
I'm really happy that you've chosen to take this course,
so let's get started with some background information about Prowler.
Prowler was originally created by Toni de la Fuente and has been actively
maintained for several years and is publicly available on GitHub. Prowler
complements your existing cloud security infrastructure by allowing you to
automatically assess your current cloud configurations against non‑security
benchmarks and checklists.
The benefit of this is that the process is automated and capable of
performing over 100 different checks and provides both user or machine
readable reports. Prowler uses the command line to operate, and the commands
to use are relatively simple and easy to learn.
This tool can be used to assess a single cloud
account in AWS or multiple accounts,
making it scalable to the needs of any enterprise.
It's currently available under the Apache 2 open source license
and is freely available to download from GitHub.
There are two main areas of interest when using Prowler.
First is choosing the assessments that are appropriate to your requirements
with over 100 different types of assessment checks available.
If, for example,
your organization uses the Center for Internet Security Framework,
then selecting the AWS CIS Benchmarks is a good start for you.
Secondly is the reporting. Prowler displays its results on screen and
also has the ability to create savable reports.
This is really useful for both distributing findings to different teams in
your organization, and also to use for building automated processes. Before I
cover the details of using Prowler and the technical commands, I would first
like to cover cybersecurity frameworks.
There are a number of frameworks available,
and the choice is really up to your organization to
decide which is the most appropriate.
NIST is one such framework that has grown in popularity.
NIST gives an organization the ability to manage the broad spectrum of
elements that make up cybersecurity with the ultimate aim of reducing
risk to your organization and its partners.
The NIST Cybersecurity Framework provides a set of standards,
guidelines, and best practice to achieve a level of
improved cybersecurity maturity,
which you can see here are distilled into identify,
protect, detect, respond, and recover.
Each area contains subcategories that are linked to
specific activities an organization needs to perform to
improve its cybersecurity maturity.
Prowler is a technology that helps an organization with
the category anomalies and events.
We can further narrow down the subcategories that link this
technology to specific technical activities.
Prowler can detect threats and enable security professionals to analyze
findings and understand the targets under attack.
Prowler forms part of the event data and correlation process.
The output from the tool can determine what impact malicious events may have.
The output from Prowler can also help to determine
suitable thresholds for security alerts.
This can include the methods used, as well as a potential impact to
inform the organization of future security strategies.
This course will demonstrate how to use Prowler and link
to the concepts being discussed here.
We also have the MITRE ATT&CK, which provides different techniques a
threat actor may use against your organization.
In this course,
we will look at cloud service discovery. We want to identify
and know which services deployed in your cloud environment
are routable to the internet.
We are going to look at how to identify internet facing
services and how common it is for potential attackers to
conduct reconnaissance of your environment,
potentially a precursor to an attack.
With the prevalence of cloud,
it's more important than ever to know what is
deployed within your cloud environment.
Finally,
MITRE Shield is one framework that covers attack techniques and how you
can defend your environments against the attacks.
Using this,
we can link the attack techniques with the methods of defense, such as DTE0014
‑ Decoy Network: Creating a target network with a set of target systems for
the purpose of active defense. We will look at one method of building an
isolated environment in the cloud that is internet facing and which could be
deployed to identify attackers.
Where does Prowler sit within your organization?
The answer depends on your organization and its culture.
Since the results of Prowler may identify cloud security
misconfigurations, such as internet facing services,
these results may generate high priority security
incidents, as such may sit within the cloud account used
exclusively by security operation teams.
Prowler can be run on a regular basis manually by an analyst and the results
reviewed on screen. Equally, Prowler can be scheduled to run automatically
every day with the report saved to a central location.
Whatever the configuration you decide,
Prowler will need to have the necessary account
privileges to your cloud environments.
As you follow along,
you will be able to take away the ability to detect internet
facing services and why it's important to do so,
including how persistent and opportunistic attackers can
be when trying to find vulnerabilities,
exploit, and gain access to cloud environments.
Cloud infrastructure security is a challenging but
exciting area for the security professional,
and Prowler is one of many useful technologies that will
help you to defend your organization.
With that,
let's get into Prowler and take that first step into
securing your cloud environment.