While I agree with the sentiment there, lapsus didn't get initial access via social engineering.

They used social engineering to stay ahead of detection.

My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC.

And that is the security responsibility nobody wants to be part of. Neither AWS and neither the organization that rents the machine.

> My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC.

It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services."

Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...

There are VPC flow logs for all things in a VPC.

this is dangerously incorrect

Yeah, no. In the ideal on premise setup you can shutdown remote access on the network level. You're not an admin? You cannot reach admin tools from your VPN. You can also always offer a personal two factor authentication for exemptions, introduce four-eyes policies, etc.

Of course, this is complicated and a big part of the reason cloud is so successful is that the engineers capable of doing complicated stuff are hired by the cloud providers. My pet theory is that FAANG pay so high salaries to prevent competition and home-grown solutions as much as possible by attracting the top x% of the talent pool.

How do you learn such things, just curious. It seems to be combination of sys admin, security and something else.

I think by starting small. Setup a raspberry pi for home automation, etc. Maybe connect a NAS or so. Add your own dedicated server with domain name, etc. My hypothesis is that you learn much more effective by learning the basics because 99% of the shiny fancy cloud-scale tools deal with inconveniences that occur when you do basic stuff in a larger setting.

I thought it was interesting that neither Facebook nor Google were listed