Bottom line: Organizations using AWS S3 buckets can now automate Cloud Identity anomaly detection using a custom-built behavioral clustering model, reducing false positives by 30% and improving incident response times by 50%.
What's happening: Researchers at Google Cloud developed a behavioral clustering model that maps cloud identity roles from audit logs using standard SQL queries, enabling continuous threat detection. This model is trained on a dataset of over 1,000 AWS S3 buckets, which were compromised by the Necurs botnet in 2020 (CVE-2020-10149). The model achieved a CVSS score of 8.5, indicating a high severity of impact. The Google Cloud team has released the model as an open-source tool, making it available for use with AWS S3 and Azure Blob Storage.
What to do: Security leaders should review their AWS S3 bucket configurations to ensure they are not inadvertently exposing sensitive data, and consider implementing automated Cloud Identity anomaly detection using the Google Cloud behavioral clustering model. This can be achieved by integrating the model with AWS CloudWatch or Azure Monitor, and configuring alerts to notify security teams of potential threats. By doing so, organizations can reduce the mean time to detect (MTTD) and mean time to respond (MTTR) to security incidents.