Skip to main content
CPEBuddy
Who Polices the Policies Privilege Escalation and Persistence with Azure Policy

Who Polices the Policies Privilege Escalation and Persistence with Azure Policy

Source: YouTube · SANS Cloud Security · published Oct 25, 2024 · 22:23

Cloud Security
No ratings yet Log in to rate
Transcript Available
Description

The speaker demonstrates how Azure Policy, intended for compliance, can be abused to escalate privileges and perform unauthorized actions.

Key Takeaways:
• The presentation focuses on exploiting Azure Policy effects to execute malicious activities rather than just enforcing compliance 2:15.
• The speaker outlines a methodology for abusing policy effects to achieve privilege escalation within the Azure environment 4:00.
• Specific scenarios are detailed where policy assignments can be manipulated to bypass security controls and gain higher access levels 6:30.

This analysis highlights critical security risks in cloud governance configurations that require strict monitoring.

Sources:

  • 0:30 Introduction to abusing Azure Policy for "bad stuff"
  • 2:15 Overview of the talk's agenda and vulnerability focus
  • 4:00 Explanation of policy effect exploitation
  • 6:30 Details on privilege escalation scenarios

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

hey everyone um thanks very much for being here sticking it out to The Bitter End I think it was sort of fortuitous that there was a talk before this that touched on the idea of policy um because this talk is you could call it you know using policy and anger it's a little bit of a vulnerability talk um Microsoft would probably not refer to it as a vulnerability but I'm going to talk about how you can use the Azure policy service for bad stuff um okay quick agenda I'm going to talk about what the Azure policy service is and then I'm going to talk about abusing what's called an effect and then I'm going to talk about scenarios that allow you to effectively escalate your privileges okay if you wanted to summarize the whole talk in a slide this is basically it um Microsoft has this compliance …