Wiz Introduces PEACH Framework for Assessing Cloud Tenant Isolation
Summary
Wiz presents PEACH, a framework for evaluating tenant isolation in cloud applications, with five hardening factors and remediation guidance. A ChaosDB case study illustrates how isolation gaps contributed to the Azure Cosmos DB vulnerability.
Key points
- PEACH aims to help model tenant isolation, evaluate security posture, and identify improvements in cloud applications.
- Its review considers interface complexity, whether interfaces are shared or duplicated per tenant, the security boundaries used, and how strongly they are implemented.
- The framework's five hardening factors are privilege, encryption, authentication, connectivity, and hygiene.
- Suggested remediation includes reducing interface complexity, strengthening tenant separation, and increasing interface duplication while considering operational constraints.
- In its ChaosDB case study, Wiz describes an attack sequence involving an embedded Jupyter Notebook, local privilege escalation, firewall changes, backend access, and retrieval and decryption of other tenants’ credentials.
- Wiz's analysis identified gaps including access to shared administrative credentials, shared encryption keys, unvalidated self-signed certificates, and network controls enforced only within the container.
Article Details
- Topic
- PEACH framework for modeling and improving tenant isolation in cloud applications
People
Adam CallisShared input during development of the PEACH framework.Cfir CohenShared input during development of the PEACH framework.Christophe PariselShared input during development of the PEACH framework.Daniel PittnerShared input during development of the PEACH framework.Joseph KjarShared input during development of the PEACH framework.Kat TraxlerShared input during development of the PEACH framework.Mike KuhnShared input during development of the PEACH framework.Srinath KuruvadiShared input during development of the PEACH framework.
Products
Azure Cosmos DBChaosDB was a cross-tenant vulnerability in Azure Cosmos DB disclosed by Wiz in August 2021, which could have allowed malicious actors to access data belonging to any Cosmos DB customer. The attack sequence consisted ofJupyter Notebookdata belonging to any Cosmos DB customer. The attack sequence consisted of deploying an embedded Jupyter Notebook, exploiting a local privilege escalation vulnerability, modifying firewall rules to gain