Abstract: Cloud computing architecture is described for implementing test modules in a communication-controlled cloud environment with access to private data. The test modules perform synchronous tests on the private data and export test results to an analytic environment subject to data export policies. An analytic application is used to asynchronously analyze the test results in the analytic environment. The cloud computing architecture alternatively or additionally includes an interface for deploying investigation-bound cloud environments in restricted subnets. A collection of software is instantiated in the investigation-bound cloud environment, and the investigation-bound cloud environment may be accessed with remote access credentials using a remote access protocol for testing the collection of software. Information about the investigation-bound cloud environment displayed in the analytic application, and the analytic application and the restricted subnet are forcibly deleted when the investigation is complete.

Abstract: Techniques for detecting and tracking disposable email addresses are detected. A first email associated with a first domain and a second email associated with a second domain are received. The first domain and the second domain may be different. An analysis is performed on a plurality of DNS (domain name system) records comprising at least a first DNS record of a first type associated with the first email and a second DNS record of a second type associated with the second email. The first type and the second type are different. Whether a correlation of information amongst the plurality of DNS records satisfies a security criterion is determined. In an example, responsive to (1) determining that the first domain has been flagged as malicious and (2) determining that the correlation of information amongst the plurality of DNS records satisfies the security criterion, the second domain is flagged as malicious.

Abstract: Techniques for detecting anomalous domain name system (DNS) query semantics are disclosed. A DNS query, which is to be routed to a DNS server, is received. The DNS query is parsed. Sensitive information within the DNS query is detected. In response to detecting the sensitive information within the DNS query, the DNS query is flagged as including the sensitive information. In an example, in response to flagging the DNS query as including the sensitive information, the DNS query is blocked from being transmitted to its target destination.

Abstract: Techniques for detecting inter-tenancy exfiltration of data in a cloud environment are disclosed. A log that includes information associated with receipt of a service message at a gateway within a cloud environment is accessed. Based on the log, (i) originating information of the service message (such as identification of an originating tenancy of the service message) and (ii) target information of the service message (such as identification of a target tenancy of the service message) are determined. The originating information and the target information are compared. A mismatch between the originating information of the service message and the target information of the service message is detected. In response to the detected mismatch between the originating information of the service message and the target information of the service message, information indicative of the detected mismatch is caused to be presented at a user interface.

Abstract: Techniques for undertaking containment actions in response to detection of stealing of non-user principals within a cloud environment are disclosed. Usage of a non-user principal by a first non-user entity is detected within a cloud environment, wherein the non-user principal was originally assigned to a second non-user entity that is different from the first non-user entity. A detection is made as to whether the non-user principal is assigned to a dynamic group of non-user entities within a tenancy. A detection is made as to whether the non-user principal is an instance principal, a resource principal, or a service principal. One or more containment actions are undertaken, based at least in part on one or both of (i) detecting whether the non-user principal is assigned to the dynamic group of non-user entities and (ii) detecting whether the non-user principal is an instance principal, a resource principal, or a service principal.

Abstract: Techniques for detected reuse of a public key of a public/private cryptographic key pair within a cloud environment are disclosed. A database maintained within a cloud environment is accessed, the database storing a plurality of public keys. Each public key has a corresponding attribute, and the database further stores a plurality of attributes corresponding to the plurality of public keys. Each public key is associated with either (i) a corresponding user account of a corresponding tenancy of the cloud environment or (ii) a compute instance hosted within a corresponding tenancy of the cloud environment. A number of times a first public key or a first attribute corresponding to the first public key occurring within the database is determined. Responsive to the number of times being equal to or greater than a threshold number, the first public key is tagged as being reused for at least the threshold number of times.

Abstract: Techniques for anonymization and storage of Internet Protocol (IP) addresses are disclosed. An IP address is processed, to generate a character value. The character value is generated from one of (i) the IP address, (ii) a modified version of the IP address generated by applying a random or pseudo-random seed to the IP address, or (iii) a truncated version of the IP address generated by setting a pre-selected number of least significant bits of the IP address to zero. The character value is encoded using an encoding scheme, to generate a first encoded character value for the IP address. The IP address is mapped to either (i) the first encoded character value, or (ii) a second encoded character value that is at least in part similar to the first encoded character value. The mapped first encoded character value or the second encoded character value is stored in a storage repository.

Abstract: Cloud computing architecture is described for implementing test modules in a communication-controlled cloud environment with access to private data. The test modules perform synchronous tests on the private data and export test results to an analytic environment subject to data export policies. An analytic application is used to asynchronously analyze the test results in the analytic environment. The cloud computing architecture alternatively or additionally includes an interface for deploying investigation-bound cloud environments in restricted subnets. A collection of software is instantiated in the investigation-bound cloud environment, and the investigation-bound cloud environment may be accessed with remote access credentials using a remote access protocol for testing the collection of software. Information about the investigation-bound cloud environment displayed in the analytic application, and the analytic application and the restricted subnet are forcibly deleted when the investigation is complete.

Abstract: Techniques for detected reuse of a public key of a public/private cryptographic key pair within a cloud environment are disclosed. A database maintained within a cloud environment is accessed, the database storing a plurality of public keys. Each public key has a corresponding attribute, and the database further stores a plurality of attributes corresponding to the plurality of public keys. Each public key is associated with either (i) a corresponding user account of a corresponding tenancy of the cloud environment or (ii) a compute instance hosted within a corresponding tenancy of the cloud environment. A number of times a first public key or a first attribute corresponding to the first public key occurring within the database is determined. Responsive to the number of times being equal to or greater than a threshold number, the first public key is tagged as being reused for at least the threshold number of times.

Abstract: Techniques for detecting inter-tenancy exfiltration of data in a cloud environment are disclosed. A log that includes information associated with receipt of a service message at a gateway within a cloud environment is accessed. Based on the log, (i) originating information of the service message (such as identification of an originating tenancy of the service message) and (ii) target information of the service message (such as identification of a target tenancy of the service message) are determined. The originating information and the target information are compared. A mismatch between the originating information of the service message and the target information of the service message is detected. In response to the detected mismatch between the originating information of the service message and the target information of the service message, information indicative of the detected mismatch is caused to be presented at a user interface.

Abstract: Cyber-security techniques are described for monitoring a cloud environment and identifying potential problems, including malicious threats, to the monitored cloud environment using operational telemetry. Techniques are described for monitoring and collecting data related to reverse or recursive DNS (rDNS) traffic associated with a monitored cloud environment. The recursive DNS traffic includes recursive DNS (rDNS) requests originating from the cloud environment and responses to those requests received from DNS resolvers. This collected data is then analyzed to identify potential threats to the monitored cloud environment. The collected data may be analyzed to identify potential sources of threats and to identify one or more portions of the cloud environment that are the targets of the threats. The analysis may trigger alerts to be generated, actions to be performed (e.g., protective measures), reports to be generated, patterns to be recognized, etc.

Abstract: Techniques for detecting inter-tenancy exfiltration of data in a cloud environment are disclosed. A log that includes information associated with receipt of a service message at a gateway within a cloud environment is accessed. Based on the log, (i) originating information of the service message (such as identification of an originating tenancy of the service message) and (ii) target information of the service message (such as identification of a target tenancy of the service message) are determined. The originating information and the target information are compared. A mismatch between the originating information of the service message and the target information of the service message is detected. In response to the detected mismatch between the originating information of the service message and the target information of the service message, information indicative of the detected mismatch is caused to be presented at a user interface.

Abstract: Techniques for detecting stealing of principals in a cloud environment are disclosed. A request for a non-user principal to be used within a cloud environment is received. A log, which includes information associated with a receipt of the request for the non-user principal, is accessed. Based at least in part on the log, originating information of the request is determined. An anomaly associated with the originating information of the request is detected. In response to detecting the anomaly associated with the originating information of the request, information indicative of the detected anomaly associated with the originating information of the request is caused to be presented. In an example, the non-user principal is one of an instance principal, a resource principal, or a service principal to be assigned to a compute instance, a cloud resource, or a service, respectively, of the cloud environment.

Abstract: Techniques for detected reuse of a public key of a public/private cryptographic key pair within a cloud environment are disclosed. A database maintained within a cloud environment is accessed, the database storing a plurality of public keys. Each public key has a corresponding attribute, and the database further stores a plurality of attributes corresponding to the plurality of public keys. Each public key is associated with either (i) a corresponding user account of a corresponding tenancy of the cloud environment or (ii) a compute instance hosted within a corresponding tenancy of the cloud environment. A number of times a first public key or a first attribute corresponding to the first public key occurring within the database is determined. Responsive to the number of times being equal to or greater than a threshold number, the first public key is tagged as being reused for at least the threshold number of times.

Abstract: Cyber-security techniques are described for monitoring a cloud environment and can be used to identify potential problems, including malicious threats, to the monitored cloud environment using operational telemetry. Techniques are described for monitoring and collecting data related to reverse or recursive DNS (rDNS) traffic associated with a monitored cloud environment. The recursive DNS traffic includes recursive DNS (rDNS) requests originating from the cloud environment and responses to those requests received from DNS resolvers. This collected data is then analyzed to identify potential threats to the monitored cloud environment. The collected data may be analyzed to identify potential sources of threats and to identify one or more portions of the cloud environment that are the targets of the threats. The analysis may trigger alerts to be generated, actions to be performed (e.g., protective measures), reports to be generated, patterns to be recognized, etc.

Abstract: A method for detecting an unaccounted tenancy within a cloud environment is disclosed. The method includes storing, within a first database, (i) identifiers of a set of active cloud resources, and (ii) for each active cloud resource, an identifier of a corresponding tenancy; and storing, within a second database, (i) identifiers of a set of tenancies, and (ii) for each tenancy within the set of tenancies, a corresponding tenancy status. Within the second database, each of a first subset of the set of tenancies has an active status, and each of a second subset of the set of tenancies has a terminated status. The method includes querying the first and second databases to identify a first active cloud resource within a first tenancy, such that the first tenancy has a terminated tenancy status; tagging the first tenancy with an unaccounted tag; and undertaking mitigating actions for the unaccounted first tenancy.

Abstract: Cloud computing architecture is described for implementing test modules in a communication-controlled cloud environment with access to private data. The test modules perform synchronous tests on the private data and export test results to an analytic environment subject to data export policies. An analytic application is used to asynchronously analyze the test results in the analytic environment. The cloud computing architecture alternatively or additionally includes an interface for deploying investigation-bound cloud environments in restricted subnets. A collection of software is instantiated in the investigation-bound cloud environment, and the investigation-bound cloud environment may be accessed with remote access credentials using a remote access protocol for testing the collection of software. Information about the investigation-bound cloud environment displayed in the analytic application, and the analytic application and the restricted subnet are forcibly deleted when the investigation is complete.

Abstract: Cloud computing architecture is described for implementing test modules in a communication-controlled cloud environment with access to private data. The test modules perform synchronous tests on the private data and export test results to an analytic environment subject to data export policies. An analytic application is used to asynchronously analyze the test results in the analytic environment. The cloud computing architecture alternatively or additionally includes an interface for deploying investigation-bound cloud environments in restricted subnets. A collection of software is instantiated in the investigation-bound cloud environment, and the investigation-bound cloud environment may be accessed with remote access credentials using a remote access protocol for testing the collection of software. Information about the investigation-bound cloud environment displayed in the analytic application, and the analytic application and the restricted subnet are forcibly deleted when the investigation is complete.

Abstract: Cyber-security techniques are described for monitoring a cloud environment and identifying potential problems, including malicious threats, to the monitored cloud environment using operational telemetry. Techniques are described for monitoring and collecting data related to reverse or recursive DNS (rDNS) traffic associated with a monitored cloud environment. The recursive DNS traffic includes recursive DNS (rDNS) requests originating from the cloud environment and responses to those requests received from DNS resolvers. This collected data is then analyzed to identify potential threats to the monitored cloud environment. The collected data may be analyzed to identify potential sources of threats and to identify one or more portions of the cloud environment that are the targets of the threats. The analysis may trigger alerts to be generated, actions to be performed (e.g., protective measures), reports to be generated, patterns to be recognized, etc.