本研究透過深入分析三個重大資訊外洩案例：SolarWinds 供應鏈攻擊事件、Target 資料外洩事件和 Capital One 銀行個資外洩事件，利用 MITRE ATT&CK 框架和 Cyber Kill Chain 模型對攻擊者的行為模式進行評估，找出這些案例中帳號及憑證管理的共同弱點。研究發現，攻擊者往往利用被竊取的憑證，繞過存取控制機制，非法存取雲端或地端中的敏感資訊。為了緩解此風險，本研究提出了一個適用於 AWS、Azure和GCP等主流公有雲平台的低成本解決方案，在不需要異動現有架構前提下，透過 IP 地址範圍限制來加強帳號和憑證的存取控管。通過在權限管理服務中設定 IP 地址範圍限制策略，可以確保只有來自企業內部網路或其他可信任 IP 範圍的請求才能存取雲端資源。實驗結果證明，此方法可以有效阻止來自企業外部 IP 的非法存取，從而降低了帳號憑證被盜用的風險。 本研究的主要貢獻在於系統性分析了三起重大資訊外洩案例，找出了帳號及憑證管理的共同弱點；提出了一個適用於主流公有雲平台的低成本帳號安全解決方案；詳細介紹三大公有雲平台中實施 IP 範圍限制的具體步驟和配置方法。提出的解決方案具有實際的應用價值，為中小企業提升雲端資源安全性提供了一個成本低廉且可行的途徑。 ;This study thoroughly analyzes three major data breach incidents: the SolarWinds supply chain attack, the Target data breach, and the Capital One data breach. Using the MITRE ATT&CK framework and Cyber Kill Chain model, it evaluates attacker behavior and identifies common weaknesses in account and credential management. The research finds that attackers often use stolen credentials to bypass access controls and illegally access sensitive cloud or on-premises information. To mitigate this risk, the study proposes a low-cost solution for major public cloud platforms like AWS, Azure, and GCP. Without altering existing infrastructure, it enhances account and credential access control through IP address range restrictions. By setting IP range restriction policies in access management services, only requests from the internal corporate network or other trusted IP ranges can access cloud resources. Experimental results show this method effectively blocks unauthorized access from external IPs, reducing the risk of credential theft. The study′s main contributions include a systematic analysis of three major data breaches to identify common weaknesses in account and credential management, proposing a low-cost security solution for mainstream public cloud platforms, and detailing the steps and configurations for implementing IP range restrictions. This solution offers practical value, providing a cost-effective approach for small and medium-sized enterprises to enhance cloud resource security.
