Videos

Learn how Check Point CloudGuard can help you unify security for your multi-cloud environments and enhance your network security, posture management, application security, and centralize visibility.

For more information, visit: https://www.checkpoint.com/solutions/cloud-security/

Learn advanced GSL scripting policies.

For more information, visit: https://www.checkpoint.com/products/cloud-security-posture-management/

This video is unavailable.

CloudGuard Intelligence is an excellent tool for cloud native threat security forensics. It offers machine learning visualization, and real-time context of threats and anomalies across your multi-cloud environment.

For more information, visit: https://www.checkpoint.com/products/cloud-intelligence-threat-hunting/

This video is an introduction into the Check Point CloudGuard and HashiCorp Consul integration. Check Point Software Technologies integrates directly with Consul Network Infrastructure Automation to dynamically manage registration/de-registration of Consul services. This integration allows teams to quickly deploy applications through automation, which cuts down on security operation overhead and protects against misconfigurations.

For more information, visit https://www.hashicorp.com/integrations/checkpoint-software/consul

CloudGuard Container Protection includes a Runtime Protection Module which is broken down in this video. The protection is based on near real time monitoring on kernel system calls performed by workload containers. With both signature based and behavioral profiling engines, CloudGuard offers valuable real time monitoring and alerting on your containers and Kubernetes environments.

For more info, visit: https://www.checkpoint.com/products/cloudguard-container-security/

Understand how the most infamous breach of the past year occurred in the second installation of Cloud Threat Hunting: Attack & Investigation Series. This video provides a step by step analysis of the attack on a major financial institution. It then illustrates how to investigate this type of attack using the CloudGuard Intelligence & Threat Hunting solution.

For more information, visit https://www.checkpoint.com/products/cloud-intelligence-threat-hunting/

Transcript: The following attack flow is similar to the one used in the Capital One breach which started with an attacker taking advantage of a misconfiguration on the application layer. This allowed the attacker to do a Server side request forgery attack – which basically let the attacker tell the server to execute a HTTP request on their behalf. This vulnerability was used to query the metadata service on the EC2 to get the information they wanted.

So they started with metadata and they will go into IAM and then go into security credentials, and finally they get to EC2-RDS-Role. This is the role that is attached to this EC2 Instance.

Once the attacker queries it they are able to get the credentials... they have an Access Key and Token.

The attacker exports the tokens into their environment into a cred.sh file. They source that file and at that point they have the credentials of the asset and can assume the EC2_RDS role.

As you can see they do not have S3 permissions yet. So they will do something known as an enumeration technique to discover different role names within that account. This involves using dictionaries of most common role names that exist in the wild, known as Enumerable Role Names. Attackers are able to easily check if those role names exist in your account.

The attacker is testing out different common role names that have to do with full access for an S3…they will be going after as much access as possible. So far they haven’t been successful…until now. There is no error on this last one that they guessed.

They have now assumed the S3FullAccess role from the EC2-RDS role they originally stole the credentials of. They will do the same thing here – export the tokens and source it.

Now they can steal the entire storage from this account.

The attacker uses Tor to exfiltrate the data. They enable tor on their machine, use ls to receive all the information, then the sync command to steal everything to their own account.

The first alert for this investigation is Successful API request originated from a Tor exit node which is a huge red flag for any environment. Click inspect to investigate further. From this visualization I can see the entire attack flow.

It starts with a web server that was able to use the S3FullAccess role token to access the S3 bucket. If we click on the S3Full access token we see in the timeline that it assumed the role.

Now the purpose of accessing that S3 bucket and assuming the role was getting access to the sensitive data. And again if we go into timeline, we can see the actions that were taken. We see a ListObjects API call that the attacker used to understand what they could steal. And Get-Objects API calls where the attacker actually exfiltrated the sensitive data.

The next alert is Abuse of unsuccessful AssumeRole. This has to do with the enumeration technique shown in the attack segment where the attacker guessed multiple different variations of the role name S3 Full Access until they managed to guess the right one and could assume the role of S3FullAccess.

Looking at the logs to investigate further, we see four failed AssumeRole API calls and one at the top that succeeded which was for the S3FullAccess. Looking at the actual log information, under EVENT the status will either say Failure or Success.

The last alert we will touch on is Abuse of access token generated by STS dedicated for EC2. Basically this says that an STS token which was supposed to be used just for the EC2 was used by an external IP. This is alarming and should be inspected further.

We can see the web server here. Remember that the Role for this web server was EC2RDS. The attacker did an STS request from that role to move to the S3 Full Access role whose token we see here. From there, they could access the S3 bucket.

Check Point partners with Silver Peak Systems to transform branch office SD-WAN security with top-rated threat prevention, easy deployment, under a unified threat management platform that reduces operational expenses up to 40%. Learn more about Check Point’s Branch Cloud Security solution here: https://www.checkpoint.com/products/branch-cloud-security/

Jonathan (Yoni) Lebowitsch, Head of Cloud Architects at Check Point, talks about how Cloudguard integrates with Azure Sentinel.

Check Point CloudGuard for Microsoft Azure provides advanced threat prevention security to protect customer Azure public and Azure Stack hybrid cloud environments from malware and other sophisticated threats. As a Microsoft Azure certified solution, CloudGuard enables easily and seamlessly secures workloads, data and assets while providing secure connectivity across your Azure cloud and on-premises environments.

For more information, visit
https://www.checkpoint.com/products/iaas-public-cloud-security/
https://pages.checkpoint.com/cloudguard-iaas-demo.html
https://www.checkpoint.com/about-us/contact-us/
https://www.youtube.com/watch?v=wDFWAEb6myA

Check Point CloudGuard IaaS is an integration partner for Amazon VPC Ingress Routing, announced at AWS re:Invent 2019. The integration provides customers with smaller deployments with an easier, more efficient and more natural way to redirect traffic flowing into a VPC for advanced AWS security.

For more information on IaaS Public Cloud Security, visit: https://www.checkpoint.com/products/iaas-public-cloud-security/

Try a free demo of CloudGuard IaaS: https://pages.checkpoint.com/cloudguard-iaas-demo.html

Read our Blog: https://blog.checkpoint.com/2019/08/14/a-guide-to-cloudguard-iaas-offerings-in-the-aws-marketplace/

Read AWS blog on VPC integration: https://aws.amazon.com/blogs/aws/new-vpc-ingress-routing-simplifying-integration-of-third-party-appliances/