“There is very little info out,” said Kellman Meghu, chief technology officer of Canadian incident response firm DeepCove Cybersecurity, “but this does sound bad. This is why I force all my users to use AWS Identity Center sign on. No IAM-generated keys, and admin accounts are only activated through a ‘break glass’ strategy, where two people are needed to authenticate.”
By “break glass” strategy, Meghu said he meant that the AWS root/admin account that controls all of an organization’s cloud infrastructure is stored outside of AWS on a system that requires authorization from both the CEO and CTO, via credentials and hardware tokens. This access generates an alert, so if there was an unauthorized attempt to sign in, the CEO and CTO would know.
“I personally live in constant fear of this sort of thing happening” he said. “I create multiple separate AWS accounts using the AWS Organizations feature so accounts are completely isolated from each other. For example, there can be a ‘dev ORG’ for testing with no real data, and a ‘uat ORG’ for user testing with some data, and a ‘prod ORG’ where no one is allowed. You can also break things down so different application types get their own Organizations, which limits lateral movement. Azure has similar setup and options, which are called Tenants.
