Hacking and Securing Cloud Infrastructure

Whether you are an Architect, Developer, Pentester, Security or DevOps Engineer, or anyone with a need to understand and manage vulnerabilities in a Cloud environment, understanding relevant hacking techniques, and how to protect yourself from them, is critical. This course covers both the theory a well as a number of modern techniques that may be used to compromise various Cloud services and infrastructure.

Prior pentest / security experience is not a strict requirement, however, some knowledge of Cloud Services and a familiarity with common Unix command line syntax will be beneficial.

INTRODUCTION TO CLOUD COMPUTING

• What is cloud and Why it matters
• Types of clouds and cloud services
• What changes from conventional security models
• Shared responsibility model (pizza as a service v2.0)

ATTACKING CLOUD SERVICES

• Conventional vs cloud infra assessment
• Legalities around Cloud Pentesting
• How to approach pentesting cloud services
• Understanding Metadata API
• Understand the attack surface in each type of cloud
• Enumerating for cloud assets

GAINING ENTRY IN CLOUD ENVIRONMENT

• Lambda attacks
• Web application Attacks
• Exposed Service ports

ATTACKING SPECIFIC CLOUD SERVICES

• Storage Attacks
• Azure AD Attacks
• Financial Attacks
• IAM Attacks : Shadow admins
• Dormant assets
• Google Dorking in Cloud Era

POST - EXPLOITATION

• Maintain access after the initial attack
• Post access asset enumeration
• Extracting secrets from Snapshot access

DEFENDING THE CLOUD ENVIRONMENT

• Setting up Monitoring and logging of the environment
• Catching attacks using monitoring and logging
• Metadata API Protection

HOST BASE DEFENCES FOR IAAS

• Windows server auditing
• Linux Server Auditing

AUDITING AND BENCHMARKING OF CLOUD

• Prepare the environment for the audit
• Automated auditing using open source tools
• Golden Image / Docker image audits
• Relevant Benchmarks for cloud
• Continuous inventory monitoring
• Continuous monitoring to Detect changes in cloud environment