Name: MBIYDZENYUY WENDY BONGSISI
Matricule: ICTU20233816
Course: Cloud Computing Security
REPORT ON ACTIVITIES DONE ON RISK MANAGEMENT AND SECURITY IN THE CLOUD
Activity 2 – Threat Modeling
Tool: OWASP Threat Dragon
Report:
We modeled a fintech cloud application that processes payments. The system includes:
- Client Application (mobile/desktop)
- API Gateway
- Payment Processing Service
- Database (customer & payment data)
- Cloud Storage
STRIDE was applied to identify threats:
- Spoofing: Stolen API keys, fake user identities.
- Tampering: Unauthorized changes to payment data.
- Repudiation: Users denying legitimate transactions.
- Information Disclosure: Exposure of personal and financial data.
- Denial of Service: Overloading payment service.
- Elevation of Privilege: Hackers gaining admin rights.
Video Script:
In this section of the video, I will introduce the fintech cloud app architecture using OWASP
Threat Dragon. I will show the main components: client app, API gateway, payment service,
database, and storage. Then, I will apply the STRIDE methodology by labeling each
component with potential threats. For example, the API gateway is vulnerable to spoofing
and DoS attacks, while the database faces risks of tampering and data leakage. The final
diagram will be displayed on screen.
Activity 3 – Vulnerability Assessment
Tools: DVWA in a sandbox + OpenVAS scanning tool.
Report:
DVWA was launched in a sandbox environment to simulate a vulnerable web app. OpenVAS
was used to scan the application. The scan identified the following issues:
- SQL Injection
- Cross-Site Scripting (XSS)
- Weak password security
- Insecure session management
Comparison with Capital One Case:
- Capital One's breach occurred due to a misconfigured WAF combined with an SSRF
vulnerability. This is similar to how DVWA demonstrates risks such as injection and poor
access controls.
Video Script:
In this video section, I will start DVWA inside a sandbox and briefly explain that it is
designed to be intentionally insecure for testing purposes. Next, I will show the OpenVAS
scan dashboard, highlighting detected vulnerabilities like SQL injection and XSS. I will then
compare these results to the Capital One case, explaining how both involve
misconfigurations and exploitation of weak security controls.
Activity 4 – Incident Response Simulation
Scenario: AWS account compromise (similar to Code Spaces case).
Report:
In this simulation, we assumed that attackers gained access to AWS root credentials. The
incident response steps were:
Containment:
- Immediately revoke stolen credentials.
- Enable MFA on all accounts.
- Block attacker IPs and restrict access.
Recovery:
- Restore services from clean backups.
- Rebuild compromised infrastructure.
- Notify stakeholders and customers.
- Conduct forensic investigation.
- Implement stronger IAM policies.
Video Script:
In this part of the video, I will explain the Code Spaces case, where attackers compromised
an AWS account and deleted data. I will then simulate the same situation by describing that
our root credentials were stolen. I will present a step-by-step incident response plan on
screen, starting with containment measures like revoking access and enabling MFA,
followed by recovery actions such as restoring backups and improving IAM policies.
Activity 5 – Business Continuity & Disaster Recovery Planning
Scenario: Dropbox-style outage of cloud storage services.
Report:
Business Continuity (BC) Plan:
- Switch to backup cloud storage provider.
- Provide users with temporary offline access to files.
- Establish a clear communication plan for customers.
Disaster Recovery (DR) Plan:
- Recovery Point Objective (RPO): 15 minutes.
- Recovery Time Objective (RTO): 2 hours.
- Maintain regular backups and geo-replication.
- Test failover procedures quarterly.
Video Script:
In this video section, I will present a scenario where a Dropbox-style outage occurs. I will
first explain the business continuity plan, focusing on maintaining access through backups
and customer communication. Then, I will show the disaster recovery plan with defined
RPO and RTO, as well as regular backup strategies. I will present a summary table of BC/DR
responsibilities on screen.