Course Summary
Whether you are an Architect, Developer, Pentester, Security or DevOps Engineer, or anyone with a need to understand and manage vulnerabilities in a Cloud environment, understanding relevant hacking techniques, and knowing how to protect yourself from them is critical. This course covers both the theory as well as a number of modern techniques that may be used to compromise various Cloud services and infrastructure.
This 4 Day class is the perfect class for cloud practitioners (defenders and attackers alike) who would like to have a deeper understanding of cloud environments and various attack surfaces. The training also extensively deals with defensive scenarios and various labs around defending cloud environments providing a 360 degree coverage on cloud security.
Trained delegates can:
Perform testing to identify and safely exploit complex vulnerabilities and security misconfigurations in AWS, Microsoft Azure, and Google Cloud Platform (GCP).
Design this testing around real-world attacker behaviour and tooling, making it relevant to the threats facing your organisation.
Identify the attack surface exposure created by cloud-based services such as virtual machines (VMs), buckets, container as a service (CaaS) platforms, and serverless functions.
Exploit, defend, and audit containerisation environments.
Collaboratively plan cloud defence strategies that include patching, asset inventory management, and other security controls.
Recommend and help implement cloud-based attack detection and response tactics.
Understand the business impact of cloud misconfigurations and vulnerabilities, and articulate this to key stakeholders.
Contribute to a secure cloud roadmap by understanding the balance between cloud growth and risk and the implications of different cloud architecture models.
Take on greater responsibility in the team and become an advocate of security in the wider business.
INTRODUCTION TO CLOUD COMPUTING
• Introduction to cloud and why cloud security • matters
• Comparison with conventional security models
• Shared responsibility model
• Legalities around Cloud Pentesting
• Attacking Cloud Services
ENUMERATION OF CLOUD ENVIRONMENTS
• DNS based enumeration
• OSINT techniques for cloud-based asset
• GAINING ENTRY VIA EXPOSED SERVICES
• Serverless based attacks (AWS Lambda / Azure & Google functions)
• Web application Attacks
• SSRF Exploitation over AWS ElasticBeanStalk
• Exploiting vulnerable applications over GCP and Azure
ATTACKING STORAGE SERVICES (AWS, AZURE, GCP)
• Exploring files in storage
• Exploring SAS URL’s in Azure
• Achieving privilege elevation via secrets in Storage
• Remote code Execution via storage in PaaS, FaaS environment
ATTACKING AZURE AD ENVIRONMENT
• Enumeration in Azure AD
• Various Azure Services
• Azure Service exploitation
• Stealing secrets from Azure services
IAM MISCONFIGURATION ATTACKS
• Exploiting Shadow admins in AWS and Azure
• Attacking AWS Incognito misconfigurations
EXPLOITING PLATFORM AS A SERVICE ENVIRONMENTS (AWS BEANSTALK AND OTHERS) POST – EXPLOITATION
• Persistence in Cloud
• Post exploit enumeration
• Snapshot access
• Backdooring the account
CONTAINERS AS A SERVICE AND K8S EXPLOITATION
• Understanding how container technology work (namespaces, cgroup, chroot)
• From docker to kubernetes
• Identifying vulnerabilities in docker images
• Exploiting misconfigured containers
• Exploiting docker environments and breaking out of containers
• Exploring kubernetes (k8s) environments
• K8s exploitation and breakouts
• Pivoting to host OS
DEFENDING CONTAINERS
• Container Image security basics
• Container Host security
DEFENDING K8S
• Authentication Methods and Configuration
• Native Authorization and Third Party Solutions
• Cluster Network Protections
• Monitoring K8s Environments
DEFENDING THE CLOUD ENVIRONMENT
• Identification of cloud assets
• Inventory Extraction for AWS, Azure and GCP
• Continuous inventory management
• Protection of Cloud Assets
• Principle of least privilege
• Control Panel and Data Panel Protection
• Financial Protections
• Cloud specific Protections
• Metadata API Protection
• Detection of Security issues
• Setting up Monitoring and logging of the environment
• Identifying attack patterns from logs
• Revisiting day 1 attacks via logs
• Real time monitoring of logs
• Monitoring in multi-cloud environment
• Response to Attacks
• Automated Defense techniques
• Cloud Defense Utilities
• Validation of Setup
AUDITING AND BENCHMARKING OF CLOUD
• Preparing for the audit
• Automated auditing via tools
• Golden Image / Docker image audits
• Auditing Kubernetes Environments using Opensource tools
• Windows IaaS auditing
• Linux IaaS Auditing
• Relevant Benchmarks for cloud
• CTF to reinforce learning
Other Popular Courses
CompTIA: SecurityX
- Duration: 5 Days
- Language: English
- Level: Advanced
- Exam: CAS-005
Executive Cyber Risk Certification (ECRC)
- Duration: 2 Days
- Language: English
- Level: Advanced
- Exam: ECRC
Mastering Communication & Presentation Te...
- Duration: 5 Days
- Language: Danish
- Level: Intermediate
- Exam: MCPT