Offensive Cloud Security Training

  • Learn via: Classroom / Virtual Classroom / Online
  • Duration: 2 Days
  • Download PDF
  • We can host this training at your preferred location. Contact us!
Upcoming Training

20 January 2021

2 Days

This 2-day course cuts through the mystery of Cloud Services (including AWS, Azure and G-Cloud) to uncover the vulnerabilities that lie beneath. We will cover a number of popular services and delve into both what makes them different, and what makes them the same, as compared to hacking and securing a traditional network infrastructure.

Designed for Cloud Administrators, Developers, Solutions Architects, DevOps Engineers, SOC Analysts, Penetration Testers, Network Engineers, Security Auditors, security enthusiasts and anyone who wants to take their skills to next level.

Prior pentest / security experience is not a strict requirement, however, some knowledge of Cloud Services and a familiarity with common Unix command line syntax will be beneficial.

Learning Outcomes

Whether you are an Architect, Developer, Pentester, Security or DevOps Engineer, or anyone with a need to understand and manage vulnerabilities in a Cloud environment, understanding relevant hacking techniques, and how to protect yourself from them, is critical. This course covers both the theory a well as a number of modern techniques that may be used to compromise various Cloud services and infrastructure.

Course Outline

INTRODUCTION TO CLOUD COMPUTING

  • What is cloud and Why it matters
  • Types of clouds and cloud services
  • What changes from conventional security models
  • Shared responsibility model (pizza as a service v2.0)

ATTACKING CLOUD SERVICES

  • Conventional vs cloud infra assessment
  • Legalities around Cloud Pentesting
  • How to approach pentesting cloud services
  • Understanding Metadata API
  • Understand the attack surface in each type of cloud
  • Enumerating for cloud assets

GAINING ENTRY IN CLOUD ENVIRONMENT

  • Lambda attacks
  • Web application Attacks
  • Exposed Service ports

ATTACKING SPECIFIC CLOUD SERVICES

  • Storage Attacks
  • Azure AD Attacks
  • Financial Attacks
  • IAM Attacks : Shadow admins
  • Dormant assets
  • Google Dorking in Cloud Era

POST - EXPLOITATION

  • Maintain access after the initial attack
  • Post access asset enumeration
  • Extracting secrets from Snapshot access

DEFENDING THE CLOUD ENVIRONMENT

  • Setting up Monitoring and logging of the environment
  • Catching attacks using monitoring and logging
  • Metadata API Protection

HOST BASE DEFENCES FOR IAAS

  • Windows server auditing
  • Linux Server Auditing

AUDITING AND BENCHMARKING OF CLOUD

  • Prepare the environment for the audit
  • Automated auditing using open source tools
  • Golden Image / Docker image audits
  • Relevant Benchmarks for cloud
  • Continuous inventory monitoring
  • Continuous monitoring to Detect changes in cloud environment


Contact us for more detail about our trainings and for all other enquiries!

Upcoming Trainings

Join our public courses in our Istanbul, London and Ankara facilities. Private class trainings will be organized at the location of your preference, according to your schedule.

20 January 2021

2 Days
Classroom / Virtual Classroom

Istanbul, Ankara, London
Istanbul, Ankara, London

08 March 2021

2 Days
Classroom / Virtual Classroom

Istanbul, Ankara, London
Istanbul, Ankara, London

17 May 2021

2 Days
Classroom / Virtual Classroom

Istanbul, Ankara, London
Istanbul, Ankara, London

08 June 2021

2 Days
Classroom / Virtual Classroom

Istanbul, Ankara, London
Istanbul, Ankara, London

27 September 2021

2 Days
Classroom / Virtual Classroom

Istanbul, Ankara, London
Istanbul, Ankara, London

22 November 2021

2 Days
Classroom / Virtual Classroom

Istanbul, Ankara, London
Istanbul, Ankara, London

Related Trainings

Certified in The Art of Hacking

Securing customer data is often crucial when deploying and managing web applications and network i...

  • Classroom
  • Virtual Classroom
  • Online

5 Day

Application Security for Developers

Security testing (Pen Testing) as an activity tends to capture security vulnerabilities at the end...

  • Classroom
  • Virtual Classroom
  • Online

2 Day

Practitioner Certificate in Cloud Security

This five day Certified Cloud Security Practitioner course is focused on Cloud Security, encompass...

  • Classroom
  • Virtual Classroom
  • Online

5 Day

Web Hacking Black Belt Edition

NotSoSecure is pleased to launch their much awaited advanced Web Hacking course. Much like the Adv...

  • Classroom
  • Virtual Classroom
  • Online

3 Day

Advanced Infrastructure Hacking

An Advanced Infrastructure Hacking class, new for 2017, designed for those who wish to push their...

  • Classroom
  • Virtual Classroom
  • Online

5 Day

Security Engineering on AWS

This course demonstrates how to efficiently use AWS security services to stay secure in the AWS Clou...

  • Classroom
  • Virtual Classroom
  • Online

3 Day

Microsoft Azure Security Technologies

In this course students will gain the knowledge and skills needed to implement security controls, ma...

  • Classroom
  • Virtual Classroom
  • Online

4 Day