Another significant vulnerability for identity and access management is access credentials (specifically, an access key and secret access key) that are not rotated in a programmatic manner. These credentials are tied to a specific user and any capabilities or access that that user has been granted.
Mitigation of Vulnerable AWS Credentials
Create a policy and/or process to rotate access keys every 90 days. Since AWS allows you to have two sets of keys per user, the best practice is to make the active set inactive for a short period after creating the new set of access credentials. Then, if any systems are tagged high or critical and have stopped working, you can reactivate the original credential pair while you switch to the updated set of credentials on those systems.
Along with rotation, incorporating a check such as git-secrets in your Continuous Integration (CI) process as part of the Static Application Security Testing (SAST) testing can ensure that neither you nor any of your users’ hard-coded keys in the source code will be vulnerable to theft or exploitation. The git-secrets tool scans commits and commit messages to prevent secret access keys and passwords from being added to your code repository. If a developer has added a key or secret to the code, then it will be flagged before being pushed to the repository, either public or private, and that secret can be removed and safely stored in a credential manager such as AWS Secrets Manager.
A preferred alternative, especially with larger enterprises in regulated industries, is to prevent users from using the long-term credentials of an access key and secret key. Instead, you would only provide access to AWS Security Token Service, which can set the credentials to automatically expire anywhere between 900 seconds (15 minutes) and 129,600 seconds (35 hours).
Distributed Denial of Service (DDoS) attacks are widespread and, if successful, can have a detrimental impact on an organization’s service operation. Depending on the scale of the DDoS attack, it can render an entire website unavailable, and this could cause retail e-commerce businesses significant losses in sales.
Initially, the initiator of a DDoS attack will focus on a specific target, such as a single host, network, or service, to compromise. This target will likely be a vital component of an organization’s infrastructure. During the attack, an attempt will be made to severely disrupt the performance of the target, using a massive number of inbound requests from several different distributed sources within the same period.
This creates the following two problems:
So far, you’ve only gotten a basic understanding of a DDoS attack. At a higher level, these attacks can be carried out using different patterns, as discussed in the next section.
Acedexam Training Policies
Learning resources
Other resources
Our Training Providers
