Skip to main content


The Cloud Attack Chain

In an earlier posting on Public Cloud Security Detection Use Cases, we attempted to map detections to the
traditional Lockheed Martin Kill Chain. After further reflection, we decided that cloud infrastructure threats are
sufficiently different enough to warrant a modified attack chain framework. We are releasing the
Cloud Attack Chain framework today. The Cloud Attack Chain is a simplified attack chain model that describes typical attacks on public cloud
infrastructure.  The attack chain describes how an attacker gains access to a victim’s cloud environment, how
they move laterally through the target cloud infrastructure, and what malicious actions they perform.   Our
new Whitepaper describes the four stages of the attack chain and provides detailed examples of some real-world

As a preview, the stages of the Cloud Attack Chain are:

1. Exposure: Exposure of cloud resources is at the beginning of any cloud attack. Exposure can be deliberate,
based on business trade-offs, or acci…
Recent posts

AWS ECS Integration

CloudHunter Amazon ECS Integration

Sift Security CloudHunter integrates with Amazon EC2 Container Service (ECS) to enable improved visibility and enhance detection, threat hunting, and incident response capabilities.  For ECS instances, CloudHunter provides high-fidelity anomaly detection results to identify potentially compromised instances. CloudHunter considers the quality of the baseline when determining how to prioritize alerts. Because containers are generally single-purpose and homogeneous, they have highly predictable baselines, from which CloudHunter can easily identify and prioritize abnormal behavior. CloudHunter also provides useful visualizations around ECS Instances, such as which auto scaling groups and images they are created from, and what users are responsible for any changes made to them.  

The screenshot below shows CloudHunter being used to investigate a compromised ECS instance.  The graph shows all the instances of a container, with an alert for one of the nine in…

Integrating with Amazon Inspector

Sift Security CloudHunter integrates with Amazon Inspector to enable enhanced detection, threat hunting, and accelerated incident response. Integrating AWS Inspector with CloudHunter allows organizations to take advantage of an additional security in the cloud. With AWS inspector you can: periodic files scans to identify misconfigurationsScan for insecure network protocolsScans application processes for bad default settingsScans for authentication best practices on AMI accounts.Scan installed operating system packages for a pre-determined list of CVEs
Key Features Dashboards summarize the total number of vulnerabilities, the instances with the most vulnerabilities, and other context about vulnerabilities found by your scanner.

Effective Management of Security Incidents

You'll be excited to hear that we released an additional tab under the Risks view of our product, to enable Incident Management. The Incidents tab surfaces the highest fidelity alerts that should be prioritized in terms of investigations and/or proactive hunting and enables management of those incidents.

Here's what you need to know about this new tab: What are the Key features?Visualization - dashboards and tables summarizing incidents Creation - create/edit incidents, manually or automatically Notification - set up notification options (Ticketing, Slack, Email,

Who's watching your data?

Open to the internet

Let's face it, cybersecurity can be a scary business, so what better time of year to highlight the fears of cyber crime than Halloween?
We've all heard the scary stories, read the chilling books, and watched the horror movies where someone is being watched - picture the scene with the creepy guy standing outside the house, looking back in through the window. Most of us close our curtains and lock our windows and doors at night before going to bed, hoping not to encounter the creepy guy. But If we go to great lengths to stop someone peeping into our private lives, or getting into our home, then why don't we do the same with our data; especially our data that's in the cloud. It's scary to think that a lot of data, especially on public clouds is left open to the internet. According to our security market research, nearly 80% of databases in amazon cloud are left unencrypted, of which 30% are open to the internet. The smart hackers who know about thi…