Real-World Case Studies

# Enforce IMDS restrictions — prevents SSRF-based credential theft (Capital One vector)
# Azure: Restrict access to Instance Metadata Service via NSG & Managed Identity
az vm update \
  --resource-group prod-rg \
  --name app-vm-01 \
  --set identity.type="SystemAssigned"

# Audit ALL VMs for public IP exposure and overly permissive NSGs
az vm list -d --query '[].{Name:name, PublicIP:publicIps, RG:resourceGroup}' -o table

# Terraform: Enforce Managed Identity and block metadata with Azure Policy
resource "azurerm_linux_virtual_machine" "secure" {
  identity {
    type = "SystemAssigned"  # Use managed identity, not stored credentials
  }

  # No public IP — traffic only from Application Gateway
  public_ip_address_id = null
}

# === Supply Chain Integrity (lessons from SolarWinds) ===

# 1. Verify SLSA build provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/org/app:latest

# 2. Generate and scan SBOM for vulnerabilities
syft packages ghcr.io/org/app:latest -o spdx-json > sbom.json
grype sbom:sbom.json --fail-on critical

# 3. Verify artifact signatures before deployment
cosign verify --key cosign.pub ghcr.io/org/app:latest

# 4. Monitor build system integrity (cron job)
sha256sum /usr/local/bin/build-agent > /etc/integrity/build-agent.sha256
# */5 * * * * sha256sum -c /etc/integrity/build-agent.sha256 || alert

# === Log4Shell (CVE-2021-44228) Detection & Response ===

# 1. Find vulnerable Log4j JARs
find / -name "log4j-core-*.jar" 2>/dev/null | while read jar; do
  version=$(unzip -p "$jar" META-INF/MANIFEST.MF 2>/dev/null | \
    grep Implementation-Version | cut -d' ' -f2)
  echo "$jar -> v$version"
done

# 2. Scan logs for exploitation attempts
grep -rn 'jndi:' /var/log/ 2>/dev/null

# 3. Block outbound JNDI protocols (egress containment)
iptables -A OUTPUT -p tcp --dport 389 -j DROP   # LDAP
iptables -A OUTPUT -p tcp --dport 636 -j DROP   # LDAPS
iptables -A OUTPUT -p tcp --dport 1099 -j DROP  # RMI

# 4. Emergency mitigation: remove JndiLookup class
zip -q -d log4j-core-*.jar \
  org/apache/logging/log4j/core/lookup/JndiLookup.class

# 5. Permanent fix: upgrade to Log4j >= 2.17.1

# === File Transfer Server Hardening (lessons from MOVEit) ===

# 1. Detect unauthorized web shells in MOVEit directories
Get-ChildItem -Path "C:\MOVEitTransfer\wwwroot" -Filter "*.aspx" -Recurse |
  Where-Object { $_.Name -notin @("default.aspx","login.aspx","human.aspx") } |
  Select-Object FullName, LastWriteTime, Length

# 2. File integrity monitoring vs. known-good baseline
$baseline = Import-Csv "C:\Security\moveit-baseline.csv"
Get-ChildItem -Path "C:\MOVEitTransfer\wwwroot" -Recurse |
  ForEach-Object {
    $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
    $known = $baseline | Where-Object { $_.Path -eq $_.FullName }
    if (-not $known -or $known.Hash -ne $hash) {
      Write-Warning "ALERT: $($_.FullName) status=$(if($known){'MODIFIED'}else{'NEW'})"
    }
  }

# 3. Network architecture: NEVER expose file transfer directly
# Place behind reverse proxy + WAF, restrict source IPs, enable DLP