Dave Bogle - Taking Off From Endpoints To the Cloud

### Overview In this presentation, Dave Bogle, a Linux threat researcher at Red Canary, shares his personal transition from low-level endpoint security research (focused on assembly, bits and bytes, and C programming) to cloud security. As businesses increasingly adopt cloud infrastructure for rapid prototyping, ease of deployment, and global scale, security researchers must adapt. Bogle outlines the technical mechanics of cloud environments, the conceptual hurdles of shifting away from endpoint mindsets, and practical strategies for accelerating one's cloud security research journey.

### Key Topics - **Business Drivers for Cloud Adoption:** Companies shift to the cloud for rapid prototyping, ease of deployment, global scalability, and inherent security benefits, despite some organizations deciding to remain on-premises or migrate away. - **The Anatomy of a Cloud Request:** The full lifecycle of interacting with cloud resources, starting from client devices (browsers, CLIs like AWS/gcloud/az, SDKs, or curl) making API calls across the internet to provider edge routers. - **Authentication, Authorization, and Validation Pipeline:** How incoming cloud API requests are processed through identity verification, permission checks, policy validation, and eventual execution. - **Vocabulary and Provider Dialects:** Navigating diverse cloud terminology across AWS, Azure, and GCP, and understanding how multicloud deployments multiply research complexity. - **Research Pitfalls and Mindset Shifts:** Why endpoint methodologies fail in the cloud, the challenge of interpreting telemetry from isolated events, and tracking constantly changing permissions and APIs.

### Technical Details Bogle breaks down how a client request interacts with a cloud provider by detailing the pipeline after an HTTP/HTTPS API call reaches the provider edge: 1. **Authentication Phase:** The provider validates identity using technologies such as OAuth 2.0, bearer tokens, and JSON Web Tokens (JWTs). 2. **Authorization Phase:** The provider determines whether the authenticated identity has permission to act, inspecting Identity and Access Management (IAM) policies, roles, and OAuth scopes. 3. **Validation Step:** Before execution, the request undergoes resource verification, format checks, and evaluations against broader organizational policies that can override standard IAM permissions. 4. **Execution or Rejection:** The provider either rejects the call or delegates it to the underlying service (e.g., virtual compute instances, Kubernetes clusters, storage buckets, or serverless functions like Cloud Functions and AWS Lambda).

Bogle emphasizes that underneath browser consoles and CLI wrappers, cloud services are essentially HTTP servers dispatching workloads to virtual machines and containers. He also highlights the sheer scale of cloud permissions, noting that in Google Cloud Platform (GCP) alone, permissions expanded from roughly 8,000 to approximately 11,000 within a relatively short period without distinct release markers.

### Takeaways - **Hands-on Experimentation:** Researchers must directly provision and manipulate resources using CLIs and consoles rather than relying solely on conceptual knowledge or fearing infrastructure costs. - **Master the Language and Map Dialects:** Developing cross-provider glossaries helps translate core concepts across AWS, Azure, and GCP (e.g., IAM roles, policies, and scopes). - **Focus on Identity:** Because perimeter models differ in the cloud, identity is foundational to any cloud security research. - **Contextual Storytelling in Detection:** Unlike endpoints where single events might be actionable, cloud detection requires correlating multiple distinct events and API audit logs to construct a complete incident narrative. - **Understand Actual Usage Patterns:** Given providers offer 200+ distinct services, researchers should prioritize threats by understanding how internal engineers and external customers actually configure and operate cloud workloads.