SANS Cloud Security
SANS Cloud Security
  • 403
  • 374 288
Spooky Scary Lambda Attacks | Cloud Security Webcast
In AWS, the Lambda function represents a new approach to crafting and deploying compute workflows. While they free us from the burdens of patching VMs, lurking in the dark are countless ways deployment and operations can go horribly wrong.
This talk will dive deep into the sinister ways attackers can exploit Lambda functions, turning them into gateways for intrusion and chaos. We will expose common misconfigurations, unmask why they haunt our environments, and reveal how to audit for lurking dangers in your Lambda deployments. Finally, we will explore the eerie telemetry trails that can uncover these threats.
This webcast supports content from SANS Institute SEC541: Cloud Security Threat Detection™. To learn more about this course, explore upcoming sessions, and access your FREE demo, www.sans.org/sec541/
About the Speaker:
Shaun spent 20+ years at the National Security Agency working in all aspects of cyber operations. A software engineer, manager, researcher, and operations lead, including as the technical director of the Blue, Red, and Hunt teams. Today, Shaun is a staff level Cloud Security Engineer at GitHub focusing on cloud infrastructure. Shaun is also the lead author of SANS SEC541: Cloud Security Threat Detection, which focuses on how attackers target cloud infrastructure and what security analysts, SOC operators, and detection engineers can do to protect their organizations. Learn more about Shaun here, www.sans.org/profiles/shaun-mccullough/
SANS Cloud Security focuses the deep resources of SANS on the growing threats to The Cloud by providing training, GIAC certification, research, and community initiatives to help security professionals build, deploy and manage secure cloud infrastructure, platforms, and applications.
SANS Cloud Security Curriculum: www.sans.org/cloud-security
GIAC Cloud Security Certifications: www.giac.org/focus-areas/cloud-security/
LinkedIn: www.linkedin.com/showcase/sanscloudsec/
Discord: www.sansurl.com/cloud-discord
Twitter: @SANSCloudSec
Переглядів: 179

Відео

HANDS-ON WORKSHOP | API Security Flight School: Aviata Chapter 7
Переглядів 17914 днів тому
Join Dr. Johannes Ullrich and principle instructor Jason Lam, and learn essential techniques for defending your APIs against real-world threats that you can start using immediately! In this chapter, you'll learn about the vulnerabilities of APIs in modern distributed applications and gain hands-on experience with defending against common API attacks. ACCESS THE DIGITAL WORKBOOK, SLIDES, AND ORI...
Critical CSPM Vulnerability Spotted: What You Need to Know
Переглядів 21521 день тому
Cloud vendors require extensive access to your organization's cloud environments. This includes security vendors. For example, if a security team wants to use a Cloud Security Posture Management (CSPM) tool to scan their cloud environments, the CSPM needs read access to nearly every service. They are entrusting the CSPM with their cloud data, so the CSPM needs to take great care that this acces...
SANS CloudSecNext Summit 2024 Keynote Panel
Переглядів 434Місяць тому
SANS CloudSecNext Summit 2024 Keynote Panel Panelists: Frank Kim, Fellow, SANS Institute Eric Johnson, Senior Instructor, SANS Institute Kevin Tyers, Certified Instructor, SANS Institute Casey Essary, Deputy CISO, BILL View upcoming Summits: www.sans.org/u/DuS SANS Cloud Security Curriculum: www.sans.org/cloud-security GIAC Cloud Security Certifications: www.giac.org/focus-areas/cloud-security/...
Keep Calm and How to Deploy Safely at Billion Event Scale
Переглядів 99Місяць тому
In today's high-scale and high-velocity complex operations, the process and culture are as important as the technology that supports it. In this talk, end-user unicorn AppsFlyer will talk about their journey to building a platform-as-a-product to achieve the velocity, predictability, and self-serve using GitOps to the massive scale their system today requires. We'll look at considerations like ...
Open Source Serverless Cloud Certificate Authority
Переглядів 176Місяць тому
In this talk, we’ll provide details of our recently released open-source project. After a technical overview, you’ll see a hands-on live demonstration of the CA and an example mTLS use case. You’ll learn how you could use this solution for your own applications and systems, to provide a secure and cost-effective certificate authority infrastructure. SANS CloudSecNext Summit 2024 Open-source ser...
Threat Hunting with Kusto The Query Language to Uncovering the Unknown
Переглядів 240Місяць тому
Join us for an illuminating session on leveraging Kusto, Microsoft's powerful query language, for effective threat hunting. Kusto, offers unparalleled capabilities for analyzing large volumes of data with lightning speed and precision. In this session, we'll dive into the fundamentals of Kusto and explore how it can be used to detect and investigate security threats within your organization's d...
EKS Security Safari Hunting Threats in the Wild Wild Cloud
Переглядів 139Місяць тому
Kubernetes is spreading through the world faster than a viral dance challenge on social media. As the K8S ecosystem on the cloud gains more attention and spotlight, hackers actively seek ways to bounce between clusters and clouds, aiming for unauthorized access. Join us to delve deep into the K8S security fundamentals on AWS (EKS) and their logging system. Explore K8S TTPs, K8S to AWS attack ve...
Who Polices the Policies Privilege Escalation and Persistence with Azure Policy
Переглядів 96Місяць тому
The Microsoft Azure threat matrix contains a mysterious and almost empty item: AZT508 - Azure Policy, which suggests this service can break bad but gives almost no details as to how. To quote Microsoft: “Azure Policy helps to enforce organizational standards and to assess compliance at-scale.“ How does this banal sounding service come to be used for attacking Azure users? This talk aims to fill...
Cloudy with a Chance of Meatballs Handling the Unexpected in Cloud Threat Detection
Переглядів 104Місяць тому
Threat Detection is hard- it requires deep knowledge about the platform you're detecting on, knowledge of how that platform is attacked, and the technical savvy to interpret logs and write code that detects on those attacks. So what do we do in the case of cloud platforms, where the platform and the logs are constantly changing? This presentation will cover lessons learned in cloud threat detec...
From AFT to ATO, AWS native FedRAMP through Terraform
Переглядів 81Місяць тому
The process of obtaining a FedRAMP ATO in the AWS cloud, often begins with a separation of federal and commercial resources. This separation, or sometimes a move to a new AWS account, is a long and tedious process when starting from zero. We can simplify and automate this process using Terraform with AWS Control Tower via AFT. In this talk we'll look at how Terraform, AFT, and Control tower can...
Identity Crisis Tracking Adversaries in AWS
Переглядів 120Місяць тому
Managing identities in the cloud can be a challenging task, even for seasoned cloud professionals. To be effective, cloud security practitioners must grasp how adversaries exploit this complexity to confuse defenders and evade detection. Traditional methods of tracking attackers through a single IP address are no longer sufficient-in today's cloud landscape, we must learn to trace their activit...
Provable Security Building Automated Validation of Your Cloud Security Controls
Переглядів 125Місяць тому
How well are your security controls working in your cloud environment? Would you know if they had gaps an attacker could exploit? Could you prove it? Cloud service providers ship new features at breakneck speed. Currently, AWS has over 15,000 APIs and 16,000 permissions. At this scale, it can be difficult to define proper security controls for your organization, verify they’re working as intend...
Thinking Inside the Box Effective DevSecOps for Containers
Переглядів 117Місяць тому
Containers can be a powerful DevOps tool to greatly improve the consistency and scalability of your environment. But how do we establish visibility and security in our containers without excessive overhead? We’ll start with an overview of the security challenges posed by containers, and how those can be magnified if we aren’t doing DevOps right. Next, we’ll go over DevSecOps best practices for ...
The Yin and Yang of Generative AI in Cybersecurity Opportunities and Challenges
Переглядів 131Місяць тому
The rapid advancements in Generative AI have opened up a new frontier in cybersecurity, presenting both unprecedented opportunities and daunting challenges. This presentation aims to equip attendees with the critical knowledge and tools needed to navigate the evolving threat landscape shaped by the rise of AI-powered cyber attacks. The session will delve into the dark side of Generative AI, sho...
A Needle in a Haystack How to Find a Threat Hidden in Over 6 Billion Logs Per Day
Переглядів 112Місяць тому
A Needle in a Haystack How to Find a Threat Hidden in Over 6 Billion Logs Per Day
Keynote | Security Journey at Elastic
Переглядів 71Місяць тому
Keynote | Security Journey at Elastic
Adding functionality to the AzureRM Provider for SecOps
Переглядів 55Місяць тому
Adding functionality to the AzureRM Provider for SecOps
Unpacking the Psycho Cyber IAM Kill Chain
Переглядів 113Місяць тому
Unpacking the Psycho Cyber IAM Kill Chain
When Cloud Encryption Matters From Another Layer of Access Control to a False Sense of Security
Переглядів 100Місяць тому
When Cloud Encryption Matters From Another Layer of Access Control to a False Sense of Security
Exploring Identity Integrations between the Three CSPs and their Managed Kubernetes Offerings
Переглядів 71Місяць тому
Exploring Identity Integrations between the Three CSPs and their Managed Kubernetes Offerings
Best Practices for How to Manage All Your Access from the Cloud
Переглядів 509Місяць тому
Best Practices for How to Manage All Your Access from the Cloud
HANDS-ON WORKSHOP | Making the Switch to Azure Monitor Agent: Aviata Chapter 6
Переглядів 203Місяць тому
HANDS-ON WORKSHOP | Making the Switch to Azure Monitor Agent: Aviata Chapter 6
GENAI Security: Risks and Challenges
Переглядів 313Місяць тому
GENAI Security: Risks and Challenges
HANDS-ON WORKSHOP | Centralizing Cross-Cloud Security Events: Aviata Chapter 5
Переглядів 180Місяць тому
HANDS-ON WORKSHOP | Centralizing Cross-Cloud Security Events: Aviata Chapter 5
HANDS-ON WORKSHOP | Attack and Detect Kubernetes: Aviata Chapter 4
Переглядів 2982 місяці тому
HANDS-ON WORKSHOP | Attack and Detect Kubernetes: Aviata Chapter 4
HANDS-ON WORKSHOP | Transitioning to Containerization: Aviata Chapter 3
Переглядів 3044 місяці тому
HANDS-ON WORKSHOP | Transitioning to Containerization: Aviata Chapter 3
Defending Against Path Traversal Attacks
Переглядів 2835 місяців тому
Defending Against Path Traversal Attacks
Evolution of SIEM in the Cloud
Переглядів 3945 місяців тому
Evolution of SIEM in the Cloud
Centralizing Cloud Logs and Events with Microsoft Sentinel
Переглядів 8355 місяців тому
Centralizing Cloud Logs and Events with Microsoft Sentinel

КОМЕНТАРІ

  • @Zombiedmonkey
    @Zombiedmonkey 23 дні тому

    🎉

  • @Z3kyTw0
    @Z3kyTw0 Місяць тому

    Thanks for uploading this free workshop!

  • @ranjansoumyab1963
    @ranjansoumyab1963 Місяць тому

    Other than in the Infosec webinars, podcasts or seminars;; no where I find security is a factor for consideration. Just look into any job forums or opportunity, you'll find 100 opportunities for a outdated tools admin but security is still a afterthought.

  • @SimZoneStudios
    @SimZoneStudios 2 місяці тому

    That was the most lame answer ever why you would choose sentinel. You basically just said you should only use sentinel if you are all in on the Microsoft stack and then moved on to the rest of the presentation. Sentinel is awesome even if you are not using any other Microsoft service. Down voting.

  • @MrFools123
    @MrFools123 3 місяці тому

    can't really see. the resolution is so bad.

  • @DrNeedles54
    @DrNeedles54 4 місяці тому

    I use a tool that helps with so many points you mentioned - ArmorCode - normalizes across scanners and internal data sources like CMDB + Reprioritizes based on context of internal systems + Automates manual remediation tasks + Tailored reports to various stakeholders. Check it out!

  • @noname-vl6vy
    @noname-vl6vy 4 місяці тому

    this is a big help but can you have a session where you filter the logs from the aws side before sending it to sentinel? is it even possible? how?

  • @TheAckdog
    @TheAckdog 4 місяці тому

    Appreciate the workshop. Much appreciated!

  • @jimdiroffii
    @jimdiroffii 5 місяців тому

    Thanks for the free resources! Great talk and walkthrough.

  • @TheGoodStink1
    @TheGoodStink1 6 місяців тому

    Great content, thanks Jon!

  • @AthAthanasius
    @AthAthanasius 6 місяців тому

    03:00 - The moment I read/heard about this video my immediate thought was "Er, just use prepared statements?", and wondered if there was going to be more than that to this video. I'll watch the rest now :) . Although I do note that in *PERL*, the last time I did that years ago, it was a bit of a pain if you had a use case where you wanted the *same* variable to be bound in more than one place in the statement. You couldn't do that and the workaround I found was to just copy the value into a temporary variable and reference *that* in the 2nd use (and so on with second temporary for a 3rd use etc).

    • @johannesullrich3297
      @johannesullrich3297 5 місяців тому

      Good old Perl ;) Perl DBI used to "simular" prepared statements for MySQL pre 4.0.

  • @manavkumar1071
    @manavkumar1071 6 місяців тому

    Great

  • @dmaloney1095
    @dmaloney1095 6 місяців тому

    Studying for GCFR now

  • @ram_bam
    @ram_bam 7 місяців тому

    Great stuff, Brandon!

  • @torinbainter5752
    @torinbainter5752 7 місяців тому

    Thanks Serge, I'm enjoying the content!

  • @MrKaiat
    @MrKaiat 7 місяців тому

    ah, declare -f ! That solves a mystery. Thanks Brandon!

  • @lesliefreeman1293
    @lesliefreeman1293 8 місяців тому

    ✌️ 'Promo SM'

  • @kevinfernandes4097
    @kevinfernandes4097 8 місяців тому

    Where can i find the repo with the files?

  • @kevinfernandes4097
    @kevinfernandes4097 8 місяців тому

    Where can i find the manifests ?

  • @LEARN1518
    @LEARN1518 9 місяців тому

    Thank You Brandon

  • @a.w.5097
    @a.w.5097 9 місяців тому

    Sounds like he's in tunnel of water.

  • @SomeInfoSecDude
    @SomeInfoSecDude 9 місяців тому

    Clearly explained and did not put me to sleep. Quite a feat for a very dry subject.

  • @B4EB4E
    @B4EB4E 9 місяців тому

    please do you teach powershell? i really enjoyed your teaching you are a great teacher, you should do more teachings smiles

  • @bubblyboy78
    @bubblyboy78 11 місяців тому

    So why doesn't Terraform apply catch the manually created Security Group before and after the --refresh-only?

  • @ram_bam
    @ram_bam 11 місяців тому

    Excellent presentation.

  • @Douglas_Gillette
    @Douglas_Gillette 11 місяців тому

    This conversation was great. Thank you.

  • @anthonynash8774
    @anthonynash8774 Рік тому

    This was awesome!! You mentioned providing access to your slides; however, I don't see any links for accessing them... --A

  • @nightshade37
    @nightshade37 Рік тому

    Thank you, this was well presented and easy to follow.

  • @BUY_YT_VIEWS_
    @BUY_YT_VIEWS_ Рік тому

    when are you gonna post again?

  • @onlyfaas
    @onlyfaas Рік тому

    I took SEC588 with some engineers and architects from Sketchers. A very impressive group that knows their stuff! Thanks for the interview.

  • @ram_bam
    @ram_bam Рік тому

    Are there any prerequisites for this course? I have a background in web development and am interested.

    • @mwebsec
      @mwebsec 4 місяці тому

      Understanding of OWASP Top 10 vulnerabilities

  • @IceDruid23
    @IceDruid23 Рік тому

    Thank you for this presentation. Really good quality.

  • @imwhtim
    @imwhtim Рік тому

    this is awesome, really need some more videos on Azure sentinel.

  • @thefrub
    @thefrub Рік тому

    Thank you for uploading this! This is exactly the kind of work I hope to be doing once I graduate

  • @killandy01
    @killandy01 Рік тому

    W mans

  • @CyberFiducia
    @CyberFiducia Рік тому

    Maybe setting up a script on the server that will digest the tail of the log every minute or so. Then report it to the SEIM. If there are indicators then store the verbose log and kick off an alert.

  • @Mature990
    @Mature990 Рік тому

    Remarkable presentation.

  • @PandoraApocalypse
    @PandoraApocalypse Рік тому

    Excellent one Shaun.This just keeps getting interesting 😎

  • @chidimoses5184
    @chidimoses5184 Рік тому

    blurred images. could not see any of the demo clearly.

  • @etutorshop
    @etutorshop Рік тому

    The only step missing the documentation is to enable Security Hub before we can go to the summary page.

  • @security365
    @security365 Рік тому

    Great presentation !

  • @KenSherman
    @KenSherman Рік тому

    I find this section (⚠2:45-3:50) VERY important.😐

  • @KenSherman
    @KenSherman Рік тому

    11:35-12:05 I'm glad you interpreted what recommendations or guidances are because people generally tend to not understand that. It's not law. It's a tested best practice or method to ASSIST you towards your goals successfully or with excellence.

  • @TheMightyWalk
    @TheMightyWalk Рік тому

    thanks keep going we are listening

  • @kns6132
    @kns6132 Рік тому

    good session and very helpful.

  • @Cyber-Marc
    @Cyber-Marc Рік тому

    Interesting perspective. The notes suggest the course eventually teaches the use of terraform to secure cloud environments. Why was terraform chosen over using the native IAC services for each provider?

  • @tanker7757
    @tanker7757 Рік тому

    That audio was killing me thanks to that person that stepped in and told him there was a problem

  • @anirbandas6257
    @anirbandas6257 Рік тому

    That's something fresh. Amazing!

  • @StevenUpshaw-v6c
    @StevenUpshaw-v6c Рік тому

    Thank you for this video! I didn't know the PuTTy Agent needed to run in the background to successfully connect.

  • @nrvous67
    @nrvous67 Рік тому

    Great talk love the Pet's analogy