12.9.3: Hands On Lab Exercises

Lab: Cloud Security Assessment and Remediation

Objective: Conduct a security audit of a cloud environment, identify vulnerabilities, and create a remediation plan.

Scenario: FinanceApp Corp has a cloud environment with the following (intentionally problematic) configuration:

• 3 AWS accounts (dev, staging, prod) with no organizational policies
• Root account used by 2 administrators for daily work (no MFA)
• 15 IAM users, many with AdministratorAccess policy
• 5 S3 buckets — 2 have public read access, 1 contains customer PII
• Database on RDS with encryption at rest disabled
• No CloudTrail logging enabled
• API endpoints using HTTP (not HTTPS)
• No security groups restricting inter-service traffic — all ports open within VPC
• Compliance requirement: SOC 2 Type II audit in 6 months

Instructions:

1. Security Audit (20 min): Create a security findings report. For each issue above, document: Finding | Severity (Critical/High/Medium/Low) | Risk Description | Affected Resources.
2. IAM Redesign (20 min): Design a proper IAM structure:
   • Eliminate root account usage — how?
   • Create appropriate roles for each team (developers, ops, data analysts, executives)
   • Design cross-account access strategy
   • Implement MFA policy
   • Write one sample IAM policy in JSON-like pseudocode enforcing least privilege
3. Data Protection Plan (15 min): Address data security gaps:
   • S3 bucket remediation plan (remove public access, enable encryption)
   • RDS encryption enablement strategy (note: enabling encryption on existing unencrypted DB requires specific steps)
   • API security upgrade (HTTP → HTTPS, API gateway configuration)
4. Monitoring and Compliance Setup (20 min): Design the monitoring infrastructure:
   • CloudTrail configuration (what to log, where to store)
   • SIEM integration approach
   • Alerting rules for: unauthorized access attempts, privilege escalation, public resource exposure
   • Compliance automation using AWS Config rules
5. SOC 2 Readiness Roadmap (15 min): Create a 6-month roadmap to achieve SOC 2 readiness. Prioritize the remediation items and map them to SOC 2 trust service criteria (security, availability, processing integrity, confidentiality, privacy).

Deliverables:

• Security findings report with severity ratings
• IAM redesign document with roles, policies, and sample policy code
• Data protection remediation plan
• Monitoring architecture with alerting rules
• SOC 2 readiness roadmap with milestones