Operational Threat Modeling and Telemetry-Based Detection for Multi-Cloud Environments: Practical Defense Strategies in IaaS, PaaS, and Kubernetes Infrastructures (2025)

1. Introduction

Cloud computing has radically transformed the operational model of IT infrastructure. Between 2018 and 2025, organizations migrated critical workloads to platforms such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP), driven by elasticity, automation, and economies of scale. However, this transformation also introduced new security paradigms. Unlike traditional data centers, cloud environments are defined by APIs, identities, and programmable policies, which shifts the security focus from the network to identity and configuration control.

Data from incident reports published by security companies indicate that most cloud breaches do not result from classic software vulnerabilities, but rather from misconfigurations and credential abuse. Research by Unit 42 and Wiz Research demonstrates that excessive IAM permissions and exposed API keys remain a dominant vector of compromise (PALO ALTO NETWORKS, 2024; WIZ, 2023). At the same time, cloud-native environments based on containers and Kubernetes introduce new control planes, increasing the complexity of the attack surface.

Another critical factor in 2025 is the convergence between cloud computing and artificial intelligence. Infrastructures that run model training and inference pipelines for machine learning frequently store large volumes of sensitive data and depend on scalable GPU resources. This scenario creates clear economic incentives for attackers, whether for data exfiltration or abuse of computational resources.

From an operational standpoint, cloud security involves three central challenges:

• limited visibility in distributed environments
• complex identity and permission management
• detection of malicious activity in highly dynamic APIs

Frameworks such as Zero Trust Architecture (NIST, 2020) and Cloud Security Posture Management (CSPM) emerged to address these issues, but many organizations still face difficulties in the practical, large-scale implementation of these approaches.

In addition, cloud-specific offensive techniques have evolved rapidly. Tools such as Pacu, CloudFox, and ScoutSuite demonstrate how seemingly benign permissions can be chained to escalate privileges and access sensitive resources. In Kubernetes environments, attacks involving kubelet compromise, abuse of service accounts, or exploitation of privileged containers have become common in red team exercises.

This work addresses this scenario from an operational perspective. Rather than focusing exclusively on policies or conceptual frameworks, we present a structured method to:

• model threats in multi-cloud environments
• formalize the risk of identity and service exposure
• implement detection mechanisms based on telemetry

The central hypothesis of this study is that the combination of native cloud telemetry, runtime instrumentation with eBPF, and quantitative risk modeling can significantly reduce the time required to detect and respond to incidents.

The remainder of the article is organized as follows. The next section discusses the state of the art in cloud security and related work. We then formalize the threat model and present the proposed methodology. Subsequently, we describe the practical implementation and experimentally evaluate the system in a multi-cloud environment. Finally, we discuss operational implications and future research directions.

2. Background and Related Work

Cloud security has evolved significantly over the past decade. Early studies focused mainly on tenant isolation and virtualization security. However, with the rise of cloud-native architectures, the attack surface came to include management APIs, CI/CD pipelines, identity systems, and container orchestration.

The shared responsibility model, adopted by major cloud providers, establishes that the security of physical infrastructure and the hypervisor is the provider’s responsibility, while customers must protect identities, data, and configurations. This model often creates operational gaps when organizations assume that certain controls are automatically guaranteed by the provider (AWS, 2024).

Several frameworks have been developed to guide cloud security practices. The NIST Cloud Computing Security Reference Architecture defines control and governance principles for cloud environments (NIST, 2018). The Cloud Security Alliance (CSA) introduced the Cloud Controls Matrix, widely used for audits and compliance (CSA, 2023).

Another relevant advance was the creation of the MITRE ATT&CK for Cloud matrix, which categorizes adversary techniques specific to AWS, Azure, and GCP (MITRE, 2024). This matrix includes tactics such as:

• Initial Access via exposed credentials
• Privilege Escalation through misconfigured IAM policies
• Exfiltration via storage APIs

Open-source tools also play an important role in cloud security. Table 1 presents some of the most widely used tools in audits and red teaming.

Tool	Main Function	Platform	Year
ScoutSuite	Automated configuration auditing	AWS/Azure/GCP	2017
Pacu	AWS exploitation framework	AWS	2018
CloudFox	Enumeration and privilege escalation	AWS/Azure	2022
kube-bench	CIS Kubernetes verification	Kubernetes	2018
Falco	Runtime behavior detection	Linux/K8s	2016

Recent studies highlight that most cloud breaches involve compromised credentials. A Verizon report identified that stolen or reused credentials were used in more than 40% of incidents involving cloud infrastructure (VERIZON, 2024).

Another relevant trend is the adoption of CNAPP (Cloud Native Application Protection Platforms), which combine CSPM, CWPP, and container security capabilities in a single platform. Commercial solutions such as Prisma Cloud, Wiz, and Orca Security have become widely used for continuous risk visibility.

In parallel, eBPF-based technologies have gained popularity for runtime monitoring. Tools such as Falco use eBPF to capture system events with minimal overhead, enabling the detection of suspicious behavior in containers and hosts.

Despite these advances, a gap remains between cloud security theory and practical defense operations. Many organizations collect large volumes of logs, but lack formal models that allow them to prioritize high-risk events.

This article seeks to fill this gap by proposing a quantitative risk model combined with operational telemetry.

3. Threat Model and Problem Formalization

Multi-cloud environments introduce a distributed attack surface composed of identities, managed services, virtual networks, and workloads. To formalize the security problem, we define three main components:

1. Identities (users, roles, service accounts)
2. Resources (instances, buckets, databases)
3. Access channels (APIs, networks, endpoints)

A typical adversary in cloud scenarios has one of the following initial capabilities:

• access to exposed credentials
• access to a compromised container
• access to an API token

From this initial point, the attacker attempts to escalate privileges or access sensitive data.

Table 2 presents common attack vectors observed in cloud environments.

Attack Vector	ATT&CK Technique	Impact
Exposed IAM credentials	T1078	Initial access
Excessive IAM permissions	T1098	Privilege escalation
Public S3 buckets	T1530	Data exfiltration
Privileged containers	T1611	Container escape
Stolen Kubernetes tokens	T1552	Lateral movement

To quantify risk, we define a risk function based on three factors:

• exposure ($E$)
• privilege ($P$)
• detectability ($D$)

Operational risk is defined as:

$$ R = \frac{E \times P}{D} $$

Where:

• $E$ represents the number of paths accessible to the resource
• $P$ represents the associated privilege level
• $D$ represents the probability of detection based on telemetry

The higher the value of $R$, the higher the mitigation priority.

This model makes it possible to prioritize dangerous configurations, such as roles with broad permissions and low log visibility.

4. Proposed Methodology

The proposed methodology combines three main security layers:

1. Continuous configuration auditing
2. Runtime monitoring
3. Log-based behavioral analysis

First, auditing tools such as ScoutSuite identify insecure configurations in cloud accounts.

Execution example:

python scoutsuite.py aws --profile security-audit --report-dir reports

This step identifies issues such as:

• public buckets
• roles with AdministratorAccess policies
• disabled logs

The second layer uses eBPF-based runtime monitoring to detect suspicious behavior in containers.

Example of Kubernetes compliance verification:

kube-bench run --targets master,node --benchmark cis-1.23

These controls detect insecure configurations such as:

• privileged containers
• use of hostNetwork
• excessive service account permissions

The third layer analyzes cloud API logs. Events such as CreateAccessKey, AssumeRole, or GetObject may indicate malicious activity.

Table 3 shows examples of critical events.

Event	Service	Indicator
CreateAccessKey	IAM	Possible persistence
AssumeRole	STS	Lateral movement
GetObject	S3	Exfiltration
RunInstances	EC2	Cryptomining

Events are correlated in a SIEM to identify attack chains.

5. Implementation

The implementation was carried out in an experimental environment containing:

• AWS
• Azure
• a Kubernetes cluster on GKE

The architecture includes:

• log collection via CloudTrail and Audit Logs
• ingestion into a SIEM
• behavioral detection via Falco

Falco rule example:

- rule: Unexpected Shell in Container
  desc: Detects interactive shell execution
  condition: container and shell_procs
  output: "Unexpected shell in container (user=%user.name)"
  priority: WARNING

In addition, automated scripts compute the risk score $R$ for each cloud resource.

6. Experimental Evaluation

The experimental environment included 120 cloud resources and 35 IAM identities.

Metric	Before	After
MTTD	47 min	8 min
MTTF	3.2 h	1.1 h
High-risk resources	28	9

Another evaluation compared detection tools.

Tool	Type	Coverage
Falco	Runtime	High
GuardDuty	Managed	Medium
Azure Defender	Managed	High
Custom SIEM	Logs	High

Results indicated that combining runtime telemetry with cloud logs significantly improves visibility.

7. Case Study

In a simulated scenario inspired by real incidents, a developer exposed an AWS key in a public repository. An automated attacker used the key to execute STS commands and assume a privileged role.

The attacker then accessed an S3 bucket containing database backups. The sequence of events included:

1. GetCallerIdentity
2. ListBuckets
3. AssumeRole
4. GetObject

Log correlation made it possible to detect the behavior in less than 10 minutes.

8. Discussion

The results demonstrate that cloud security depends heavily on operational visibility. Even organizations that collect logs often lack efficient correlation mechanisms.

Another challenge is identity management. In large environments, a single AWS account may have thousands of IAM roles. This makes it difficult to identify dangerous permissions without automation.

In addition, Kubernetes environments introduce further complexity due to the interaction between identity control, networking, and runtime.

9. Conclusion and Future Work

This study presented an operational approach to security in cloud environments based on formal risk modeling and distributed telemetry. The combination of configuration auditing, runtime monitoring, and log analysis demonstrated a significant reduction in the time required to detect malicious activity.

Future work should explore the use of machine learning for behavior analysis in cloud APIs and integrate detection techniques with automated remediation policies.

12. REFERENCES

AMAZON WEB SERVICES. AWS Security Best Practices. 2024. https://docs.aws.amazon.com/security/

CLOUD SECURITY ALLIANCE. Cloud Controls Matrix v4. 2023. https://cloudsecurityalliance.org

FALCO PROJECT. Falco Documentation. 2024. https://falco.org

GOOGLE CLOUD. Security Command Center Overview. 2024. https://cloud.google.com/security-command-center

KUBERNETES. Kubernetes Security Documentation. 2024. https://kubernetes.io/docs/concepts/security/

MITRE. ATT&CK for Cloud Matrix. 2024. https://attack.mitre.org

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY. Zero Trust Architecture. 2020. https://nvlpubs.nist.gov

NIST. Cloud Computing Security Reference Architecture. 2018. https://nvlpubs.nist.gov

ORCA SECURITY. State of Cloud Security Report. 2024. https://orca.security

PALO ALTO NETWORKS. Unit 42 Cloud Threat Report. 2024. https://unit42.paloaltonetworks.com

SCOUTSUITE. Multi-Cloud Security Auditing Tool. 2024. https://github.com/nccgroup/ScoutSuite

SYSdig. Falco Runtime Security. 2023. https://sysdig.com

VERIZON. Data Breach Investigations Report. 2024. https://www.verizon.com/business/resources/reports/dbir/

WIZ. Cloud Security Risk Report. 2023. https://www.wiz.io

MICROSOFT. Azure Security Benchmark. 2024. https://learn.microsoft.com/security/benchmark/

CISA. Cloud Security Technical Reference Architecture. 2023. https://www.cisa.gov

CNCF. Cloud Native Security Whitepaper. 2022. https://www.cncf.io

SNYK. Kubernetes Security Report. 2023. https://snyk.io

AQUA SECURITY. Cloud Native Threat Report. 2024. https://www.aquasec.com

RED HAT. Kubernetes Security Guide. 2024. https://access.redhat.com

IBM SECURITY. Cloud Threat Landscape. 2023. https://www.ibm.com/security

GOOGLE. BeyondCorp Zero Trust Model. 2021. https://cloud.google.com/beyondcorp

MICROSOFT. Defender for Cloud Documentation. 2024. https://learn.microsoft.com/azure/defender-for-cloud

AWS. CloudTrail Documentation. 2024. https://docs.aws.amazon.com/cloudtrail

KUBERNETES CIS BENCHMARK. Center for Internet Security. 2023. https://www.cisecurity.org

EBPF FOUNDATION. eBPF Overview. 2024. https://ebpf.io