Hacking and Securing Cloud Infrastructure

2 Days

Brand new for 2019, this 2-day course cuts through the mystery of Cloud Services (including AWS, Azure and G-Cloud) to uncover the vulnerabilities that lie beneath. We will cover a number of popular services and delve into both what makes them different, and what makes them the same, as compared to hacking and securing a traditional network infrastructure.


Class Details

Whether you are an Architect, Developer, Pentester, Security or DevOps Engineer, or anyone with a need to understand and manage vulnerabilities in a Cloud environment, understanding relevant hacking techniques, and how to protect yourself from them, is critical. This course covers both the theory a well as a number of modern techniques that may be used to compromise various Cloud services and infrastructure.

Prior pentest / security experience is not a strict requirement, however, some knowledge of Cloud Services and a familiarity with common Unix command line syntax will be beneficial. The following is the syllabus for the class:

      Introduction to Cloud Computing
      Why cloud matters
      How cloud security differs from conventional security
      Types of cloud services
      Legalities around attacking / pentesting cloud services.
      Understanding the Attack Surfaces of various Cloud offerings, such as IaaS, PaaS, SaaS, FaaS
      Exploiting serverless applications
      Owning cloud machines
      Attacking cloud services such as storage service or database services
      Examples and case studies of various cloud hacks
      Privilege escalation (horizontal and vertical) and pivoting techniques in cloud
      Obtaining persistence in cloud
      Exploiting dormant assets : Id’s, services, resources groups, security groups or more
      Cloud Infrastructure Defence
      Monitoring and logging
      Auditing Cloud Infrastructure (Manual and automated approach)
      Base Images / Golden Image auditing for Virtual Machine / Container Infrastructure
      Preventive measures against cloud attacks
      Host-based Defence
      Using Cloud services to perform defence
      Ending CTF to reinforce the learning


Who Should Take This Class?

Cloud Administrators, Developers, Solutions Architects, DevOps Engineers, SOC Analysts, Penetration Testers, Network Engineers, security enthusiasts and anyone who wants to take their skills to next level.

Prior pentest experience is not a strict requirement, however, some knowledge of Cloud Services and a familiarity with common command line syntax will be greatly beneficial.

Student Requirements

Students must bring their own laptop and must either be able to launch a Docker Container provided by us, which includes all tools required for the course, or have root/admin access and be comfortable installing command line tools and downloading and building tools from source on GitHub, such as AWS CLI and Nimbostratus and more tools.


What Students Will Be Provided With

Our own pre-bundled Docker Image containing all the tools needed to begin hacking/auditing/securing the Cloud.

Hacking Training Classes

Lab-Based Training - Written by BlackHat Trainers - Available Globally

NotSoSecure classes are ideal for those preparing for CREST CCT (ICE), CREST CCT (ACE), CHECK (CTL), TIGER SST and other similar industry certifications, as well as those who perform Penetration Testing on infrastructure / web applications as a day job & wish to add to their existing skill set.

Download the NotSoSecure Hacking Classes Brochure

Beginner Friendly

Hacking 101

The Art of Hacking

The Art of Hacking


Infrastructure Hacking


Web Hacking

Specialist Offensive Classes

2019 Edition

Advanced Infrastructure Hacking

2019 Edition

Advanced Web Hacking


Hacking and Securing Cloud Infrastructure

Specialist Defence Classes

2019 Edition

AppSec for Developers





Book Your Training

Working exclusively with 3 training delivery partners, NotSoSecure Hacking Training is available around the world.