Brand new for 2019, this 2-day course cuts through the mystery of Cloud Services (including AWS, Azure and G-Cloud) to uncover the vulnerabilities that lie beneath. We will cover a number of popular services and delve into both what makes them different, and what makes them the same, as compared to hacking and securing a traditional network infrastructure.
Whether you are an Architect, Developer, Pentester, Security or DevOps Engineer, or anyone with a need to understand and manage vulnerabilities in a Cloud environment, understanding relevant hacking techniques, and how to protect yourself from them, is critical. This course covers both the theory a well as a number of modern techniques that may be used to compromise various Cloud services and infrastructure.
Prior pentest / security experience is not a strict requirement, however, some knowledge of Cloud Services and a familiarity with common Unix command line syntax will be beneficial. The following is the syllabus for the class:
● Introduction to Cloud Computing
● Why cloud matters
● How cloud security differs from conventional security
● Types of cloud services
● Legalities around attacking / pentesting cloud services.
● Understanding the Attack Surfaces of various Cloud offerings, such as IaaS, PaaS, SaaS, FaaS
● Exploiting serverless applications
● Owning cloud machines
● Attacking cloud services such as storage service or database services
● Examples and case studies of various cloud hacks
● Privilege escalation (horizontal and vertical) and pivoting techniques in cloud
● Obtaining persistence in cloud
● Exploiting dormant assets : Id’s, services, resources groups, security groups or more
● Cloud Infrastructure Defence
● Monitoring and logging
● Auditing Cloud Infrastructure (Manual and automated approach)
● Base Images / Golden Image auditing for Virtual Machine / Container Infrastructure
● Preventive measures against cloud attacks
● Host-based Defence
● Using Cloud services to perform defence
● Ending CTF to reinforce the learning
Cloud Administrators, Developers, Solutions Architects, DevOps Engineers, SOC Analysts, Penetration Testers, Network Engineers, security enthusiasts and anyone who wants to take their skills to next level.
Prior pentest experience is not a strict requirement, however, some knowledge of Cloud Services and a familiarity with common command line syntax will be greatly beneficial.
Students must bring their own laptop and must either be able to launch a Docker Container provided by us, which includes all tools required for the course, or have root/admin access and be comfortable installing command line tools and downloading and building tools from source on GitHub, such as AWS CLI and Nimbostratus and more tools.
Our own pre-bundled Docker Image containing all the tools needed to begin hacking/auditing/securing the Cloud.
Lab-Based Training - Written by BlackHat Trainers - Available Globally
NotSoSecure classes are ideal for those preparing for CREST CCT (ICE), CREST CCT (ACE), CHECK (CTL), TIGER SST and other similar industry certifications, as well as those who perform Penetration Testing on infrastructure / web applications as a day job & wish to add to their existing skill set.
Working exclusively with 3 training delivery partners, NotSoSecure Hacking Training is available around the world.