This is cool, and really makes sense for large organizations. Do you foresee a release for smaller enterprises (something as simple as a lightweight aws integration?)
Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
11–20 of 34 posts
Re: Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
#12This is cool, and really makes sense for large organizations. Do you foresee a release for smaller enterprises (something as simple as a lightweight aws integration?)
Could definitely see us releasing some form of this for smaller companies as well, it's crazy how many vendors and how much infra even these 2 month old startups have
Re: Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
#13This is cool, and really makes sense for large organizations. Do you foresee a release for smaller enterprises (something as simple as a lightweight aws integration?)
Depends on how small. Most seed stage and early companies are more worried about product-market fit and not security. For now, we're probably best fit for companies building out their first security teams, so that's _usually_ series A and later. That said, there might be something there, I'm open to figuring something out for a smaller company.
Re: Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
#14Congrats on the launch!
Re: Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
#15How come things like this are not built into most cloud providers?
Re: Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
#16Looks great. Sent you a DM.
Re: Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
#17I was watching a competitor(?) of yours a few years ago who were trying to integrate https://github.com/WithSecureLabs/IAMSpy#iamspy with Cartography to have more insight into what, actually, the IAM Roles could do
Do you have similar plans or are those kinds of things left as an "exercise to the reader" via your Intel Plugins link? I do see https://cartography-cncf.github.io/cartography/modules/aws/s... but I also see https://github.com/cartography-cncf/cartography/blob/0.100.0... so it's hard to know what level of insight one wishes to support out of the box versus the localstack model of "open core, advanced features are $$$" type deal
Re: Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
#18How come things like this are not built into most cloud providers?
AWS has Config to give you an inventory, but that only covers AWS. My guess is that there's not much incentive for the major cloud providers to build a product to help you correlate data across other products.
Re: Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
#19Awesome project! As someone deeply familiar with this problem (ex-JupiterOne), I'd caution against asserting that 'deep level of customization' is a differentiator. Your buyer (CISO) and userbase (Sec Engs) are drowning. They (and I) don't want yet another product to build on top of. This is a key reason why Wiz is so successful -- an operator can turn Wiz on and immediately receive value, no adjustments or additions…
I would second this. No security person says "I don't have enough problems to look into."
Security spending is down, so navel gazing products are going to be a really hard sell. Figure out how to actually solve problems in an automated/semi-automated way and ship that instead.
The other issue with all of these tools is handling onboarding/integrations and getting terrible visibility as a result. A big market gap I see is a tool that can use the vulnerabilities it discovers to further information collection just like a real attacker would. Found Splunk creds in a log? Awesome, start using them. Syslog in an S3 bucket... boom. You are now hitting the stuff that every other ASM/visualization tool has missed.
Re: Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
#20I was watching a competitor(?) of yours a few years ago who were trying to integrate https://github.com/WithSecureLabs/IAMSpy#iamspy with Cartography to have more insight into what, actually, the IAM Roles could do Do you have similar plans or are those kinds of things left as an "exercise to the reader" via your Intel Plugins link? I do see https://cartography-cncf.github.io/cartography/modules/aws/s... but I also s…
> have more insight into what, actually, the IAM Roles could do
We 100% do this, see https://eng.lyft.com/iam-whatever-you-say-iam-febce59d1e3b.
We evaluate the policies for the IAM principal against the resources to determine what actions they can perform on each resource. This is configurable too; here's the set of the default permission relationships shipped in OSS: https://github.com/cartography-cncf/cartography/blob/master/...
It doesn't cover conditions since those can be wacky complicated, and it doesn't cover resource policies (yet!) but in my experience this is still a very good heuristic that is already more accurate than AWS IAM Analyzer when I played with it.
The next step we're working on is to take this access map and correlate it with event data to see which permissions are used/unused so that we can prune them for ensuring least privilege. More to come here.
Edit: adding on for the part of your question about what features are paid or OSS, our paid offering is fully hosted and includes things like automatic suggested fixes, a natural language interface, customization with our dynamic schemas, and other bells and whistles. I'm not a fan of doing things like premium modules because I don't want to ever get in the position where I'm declining a pull request in open source because it covers a premium feature; that doesn't feel right.