English
Menu

Cyber Attacks and Defense in Practice

An access key with administrator privileges allowing all operations (a long-lived credential) was written in a configuration file and given to a batch job running in the cloud. Which of the following is the most appropriate revision to reduce the damage if this key leaks?

  1. AReplace the access key string with a longer one so that attackers find it harder to guess, while keeping the current privileges unchanged
  2. BAssign a role that allows only the operations and resources the job needs, and use short-lived credentials issued automatically by the execution environment
  3. CMove the access key from the configuration file into the program's source code and manage and share it in the repository together with the source code
Show answer and explanation

Answer: B. Assign a role that allows only the operations and resources the job needs, and use short-lived credentials issued automatically by the execution environment

If a long-lived key that allows all operations leaks, an attacker can read or delete every resource in the account or create new resources for abuse, so the damage is the greatest possible. Following the principle of least privilege, assigning a role that allows only the operations and resources the job needs and switching to automatically receiving temporary credentials that expire after a few hours or so from a role attached to the virtual machine or container removes even the need to store a key. In addition, unused privileges are reviewed regularly and unusual API calls are monitored.

  • A. The length of the key concerns how hard it is to guess and does not change the size of the damage if it leaks.
  • B. Correct. Narrowing privileges and using credentials that expire quickly reduces the damage if they leak.
  • C. Writing it in the source code makes it more likely to leak through the repository and is actually more dangerous.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. An attacker obtained an employee's password and repeated the login dozens of times, flooding the employee's smartphone with notifications asking for approval. The employee got annoyed and pressed "Approve" without thinking. Which of the following is the most appropriate countermeasure to this attack?
  2. Which of the following is the correct reason why authentication with FIDO2 (WebAuthn) passkeys is considered more resistant to phishing than one-time passwords (OTPs)?
  3. A web service saw a large number of login attempts from many different IP addresses, each using a different user's ID and password pair, and some succeeded. Many of the pairs tried matched ones leaked from other services. What is this attack called?
  4. At a cloud email service that uses multi-factor authentication, an employee was lured to a login screen that looked exactly like the real one and entered a password and a one-time password. The attacker used that screen as a relay to the real service, stole the session cookie issued after login and impersonated the employee. Which of the following most appropriately describes this attack and the countermeasures?
  5. Which of the following is the most appropriate idea of privileged access management (PAM) for protecting server administrator accounts?

Comparisons in this topic