Cloud › Module 2 › Lesson 3
Misconfig Named
Misconfig named literacy lists public storage, open security groups, excessive IAM, and disabled logging — defender context on YOUR $CLOUD_LAB, not stranger exploit recipes.
Visual · t31_misconfig_named
Misconfig literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
Breaches love boring mistakes — literacy names misconfig classes so you harden sandboxes and read CSPM findings, not hunt stranger buckets.
Common cloud misconfigs: public read/write storage, 0.0.0.0/0 admin ports, over-privileged IAM roles, long-lived access keys without rotation, logging disabled, default encryption off, and overly permissive trust policies. Defenders prioritize by data sensitivity and exposure — literacy names the class; hardening fixes it on owned accounts. Cyberlium lists misconfig classes on YOUR $CLOUD_LAB — create intentional safe samples in sandbox or use courseware cards. Next: Shared Lab.
1. Misconfig classes (named, literacy only)
Storage exposure: public bucket or blob ACL. Network exposure: security group or NSG allowing world on SSH/RDP. Identity exposure: admin policy attached to broad principal or long-lived key in repo.
On $CLOUD_LAB, write three misconfig class names with one defender fix each — no steps targeting stranger tenants.
Command guide
Try these commands — Misconfig classes (named, literacy only)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP cloud misconfig (https://owasp.org/www-project-cloud-security/); AWS S3 security (https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html); CIS AWS (https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why naming beats vague 'cloud risk'
CSPM tools emit rule IDs tied to these classes — analysts who name public S3 vs open SG triage faster. Hardening checklists map one class to one control (Block Public Access, least privilege, enable CloudTrail).
Students compare CIS benchmark language to lab notes — adaptation literacy, not live stranger exploitation.
3. Literacy ≠ stranger misconfig hunting
Forbidden: scanning internet for open buckets to download data. Allowed: misconfig card — three classes, detection signal, hardening fix on $CLOUD_LAB sandbox.
Ship: misconfig named card for YOUR lab. Next: Shared Lab.
4. What you ship: misconfig named card for $CLOUD_LAB
Three misconfig classes, detection signal, hardening fix. $CLOUD_LAB named. NO stranger scans. chmod 600.
5. What you record before the next lesson
Date. Misconfig card. $CLOUD_LAB named. File t31-m02-l03-misconfig-named.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Download data from stranger public bucket 'to learn.' List misconfigs with no fix path.
Right
Write misconfig named card for YOUR $CLOUD_LAB. Next: Shared Lab.
Mission: name misconfigs and fixes on YOUR lab
1) Pick three misconfig classes. 2) Write detection signal for each. 3) Write hardening fix for YOUR sandbox. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Detection signal + fix path = CSPM finding you can actually close.
Knowledge Check
APPLY: Public cloud storage exposure is:
Multiple choice
Knowledge Check
APPLY: True or False: Open security groups to 0.0.0.0/0 on admin ports are a common customer misconfig.
True or False
Knowledge Check
APPLY: Misconfig literacy on Cyberlium avoids:
Multiple choice