Mapping Network Attack Paths

Leveraging cloud APIs to identify network risks

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

🔒 Related Stories: Network Security | Penetration Testing

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Every time I perform a penetration test or security assessment, I’m looking for ways to improve the results and meet a customer’s specific objectives. I wrote about how I created a simple web API fuzzer for one client engagement because the client wanted an API pentest. In an upcoming IANS research report, I’ll write about a tool I wrote for finding blind XSS that sends me a text message when an attack succeeds because that was the client’s primary concern. For a recent security assessment, a client wanted to know if developers could access anything in a production VPC. This objective led me to a project I’ve been meaning to work on for a while — mapping network attack paths in the cloud.

More Paths = Increased Risk

I’ve written in my book on Cybersecurity for Executives in the Age of Cloud and on this blog already about the exponential attack paths created by broad network rules. I provide a general formula as a way…