- 403
- 374 288
SANS Cloud Security
United States
Приєднався 16 чер 2020
SANS Cloud Security focuses the deep resources of SANS on the growing threats to the cloud by providing training, certification, research, and community initiatives to help security professionals build, deploy and manage secure cloud infrastructure, platforms, and applications.
SANS Cloud Security provides intensive, immersion training designed to help you and your staff master the practical steps necessary for defending systems and applications in the cloud against the most dangerous threats. The courses are full of important and immediately useful techniques that you can put to work as soon as you return to your office.
SANS Cloud Security provides intensive, immersion training designed to help you and your staff master the practical steps necessary for defending systems and applications in the cloud against the most dangerous threats. The courses are full of important and immediately useful techniques that you can put to work as soon as you return to your office.
Spooky Scary Lambda Attacks | Cloud Security Webcast
In AWS, the Lambda function represents a new approach to crafting and deploying compute workflows. While they free us from the burdens of patching VMs, lurking in the dark are countless ways deployment and operations can go horribly wrong.
This talk will dive deep into the sinister ways attackers can exploit Lambda functions, turning them into gateways for intrusion and chaos. We will expose common misconfigurations, unmask why they haunt our environments, and reveal how to audit for lurking dangers in your Lambda deployments. Finally, we will explore the eerie telemetry trails that can uncover these threats.
This webcast supports content from SANS Institute SEC541: Cloud Security Threat Detection™. To learn more about this course, explore upcoming sessions, and access your FREE demo, www.sans.org/sec541/
About the Speaker:
Shaun spent 20+ years at the National Security Agency working in all aspects of cyber operations. A software engineer, manager, researcher, and operations lead, including as the technical director of the Blue, Red, and Hunt teams. Today, Shaun is a staff level Cloud Security Engineer at GitHub focusing on cloud infrastructure. Shaun is also the lead author of SANS SEC541: Cloud Security Threat Detection, which focuses on how attackers target cloud infrastructure and what security analysts, SOC operators, and detection engineers can do to protect their organizations. Learn more about Shaun here, www.sans.org/profiles/shaun-mccullough/
SANS Cloud Security focuses the deep resources of SANS on the growing threats to The Cloud by providing training, GIAC certification, research, and community initiatives to help security professionals build, deploy and manage secure cloud infrastructure, platforms, and applications.
SANS Cloud Security Curriculum: www.sans.org/cloud-security
GIAC Cloud Security Certifications: www.giac.org/focus-areas/cloud-security/
LinkedIn: www.linkedin.com/showcase/sanscloudsec/
Discord: www.sansurl.com/cloud-discord
Twitter: @SANSCloudSec
This talk will dive deep into the sinister ways attackers can exploit Lambda functions, turning them into gateways for intrusion and chaos. We will expose common misconfigurations, unmask why they haunt our environments, and reveal how to audit for lurking dangers in your Lambda deployments. Finally, we will explore the eerie telemetry trails that can uncover these threats.
This webcast supports content from SANS Institute SEC541: Cloud Security Threat Detection™. To learn more about this course, explore upcoming sessions, and access your FREE demo, www.sans.org/sec541/
About the Speaker:
Shaun spent 20+ years at the National Security Agency working in all aspects of cyber operations. A software engineer, manager, researcher, and operations lead, including as the technical director of the Blue, Red, and Hunt teams. Today, Shaun is a staff level Cloud Security Engineer at GitHub focusing on cloud infrastructure. Shaun is also the lead author of SANS SEC541: Cloud Security Threat Detection, which focuses on how attackers target cloud infrastructure and what security analysts, SOC operators, and detection engineers can do to protect their organizations. Learn more about Shaun here, www.sans.org/profiles/shaun-mccullough/
SANS Cloud Security focuses the deep resources of SANS on the growing threats to The Cloud by providing training, GIAC certification, research, and community initiatives to help security professionals build, deploy and manage secure cloud infrastructure, platforms, and applications.
SANS Cloud Security Curriculum: www.sans.org/cloud-security
GIAC Cloud Security Certifications: www.giac.org/focus-areas/cloud-security/
LinkedIn: www.linkedin.com/showcase/sanscloudsec/
Discord: www.sansurl.com/cloud-discord
Twitter: @SANSCloudSec
Переглядів: 179
Відео
HANDS-ON WORKSHOP | API Security Flight School: Aviata Chapter 7
Переглядів 17914 днів тому
Join Dr. Johannes Ullrich and principle instructor Jason Lam, and learn essential techniques for defending your APIs against real-world threats that you can start using immediately! In this chapter, you'll learn about the vulnerabilities of APIs in modern distributed applications and gain hands-on experience with defending against common API attacks. ACCESS THE DIGITAL WORKBOOK, SLIDES, AND ORI...
Critical CSPM Vulnerability Spotted: What You Need to Know
Переглядів 21521 день тому
Cloud vendors require extensive access to your organization's cloud environments. This includes security vendors. For example, if a security team wants to use a Cloud Security Posture Management (CSPM) tool to scan their cloud environments, the CSPM needs read access to nearly every service. They are entrusting the CSPM with their cloud data, so the CSPM needs to take great care that this acces...
SANS CloudSecNext Summit 2024 Keynote Panel
Переглядів 434Місяць тому
SANS CloudSecNext Summit 2024 Keynote Panel Panelists: Frank Kim, Fellow, SANS Institute Eric Johnson, Senior Instructor, SANS Institute Kevin Tyers, Certified Instructor, SANS Institute Casey Essary, Deputy CISO, BILL View upcoming Summits: www.sans.org/u/DuS SANS Cloud Security Curriculum: www.sans.org/cloud-security GIAC Cloud Security Certifications: www.giac.org/focus-areas/cloud-security/...
Keep Calm and How to Deploy Safely at Billion Event Scale
Переглядів 99Місяць тому
In today's high-scale and high-velocity complex operations, the process and culture are as important as the technology that supports it. In this talk, end-user unicorn AppsFlyer will talk about their journey to building a platform-as-a-product to achieve the velocity, predictability, and self-serve using GitOps to the massive scale their system today requires. We'll look at considerations like ...
Open Source Serverless Cloud Certificate Authority
Переглядів 176Місяць тому
In this talk, we’ll provide details of our recently released open-source project. After a technical overview, you’ll see a hands-on live demonstration of the CA and an example mTLS use case. You’ll learn how you could use this solution for your own applications and systems, to provide a secure and cost-effective certificate authority infrastructure. SANS CloudSecNext Summit 2024 Open-source ser...
Threat Hunting with Kusto The Query Language to Uncovering the Unknown
Переглядів 240Місяць тому
Join us for an illuminating session on leveraging Kusto, Microsoft's powerful query language, for effective threat hunting. Kusto, offers unparalleled capabilities for analyzing large volumes of data with lightning speed and precision. In this session, we'll dive into the fundamentals of Kusto and explore how it can be used to detect and investigate security threats within your organization's d...
EKS Security Safari Hunting Threats in the Wild Wild Cloud
Переглядів 139Місяць тому
Kubernetes is spreading through the world faster than a viral dance challenge on social media. As the K8S ecosystem on the cloud gains more attention and spotlight, hackers actively seek ways to bounce between clusters and clouds, aiming for unauthorized access. Join us to delve deep into the K8S security fundamentals on AWS (EKS) and their logging system. Explore K8S TTPs, K8S to AWS attack ve...
Who Polices the Policies Privilege Escalation and Persistence with Azure Policy
Переглядів 96Місяць тому
The Microsoft Azure threat matrix contains a mysterious and almost empty item: AZT508 - Azure Policy, which suggests this service can break bad but gives almost no details as to how. To quote Microsoft: “Azure Policy helps to enforce organizational standards and to assess compliance at-scale.“ How does this banal sounding service come to be used for attacking Azure users? This talk aims to fill...
Cloudy with a Chance of Meatballs Handling the Unexpected in Cloud Threat Detection
Переглядів 104Місяць тому
Threat Detection is hard- it requires deep knowledge about the platform you're detecting on, knowledge of how that platform is attacked, and the technical savvy to interpret logs and write code that detects on those attacks. So what do we do in the case of cloud platforms, where the platform and the logs are constantly changing? This presentation will cover lessons learned in cloud threat detec...
From AFT to ATO, AWS native FedRAMP through Terraform
Переглядів 81Місяць тому
The process of obtaining a FedRAMP ATO in the AWS cloud, often begins with a separation of federal and commercial resources. This separation, or sometimes a move to a new AWS account, is a long and tedious process when starting from zero. We can simplify and automate this process using Terraform with AWS Control Tower via AFT. In this talk we'll look at how Terraform, AFT, and Control tower can...
Identity Crisis Tracking Adversaries in AWS
Переглядів 120Місяць тому
Managing identities in the cloud can be a challenging task, even for seasoned cloud professionals. To be effective, cloud security practitioners must grasp how adversaries exploit this complexity to confuse defenders and evade detection. Traditional methods of tracking attackers through a single IP address are no longer sufficient-in today's cloud landscape, we must learn to trace their activit...
Provable Security Building Automated Validation of Your Cloud Security Controls
Переглядів 125Місяць тому
How well are your security controls working in your cloud environment? Would you know if they had gaps an attacker could exploit? Could you prove it? Cloud service providers ship new features at breakneck speed. Currently, AWS has over 15,000 APIs and 16,000 permissions. At this scale, it can be difficult to define proper security controls for your organization, verify they’re working as intend...
Thinking Inside the Box Effective DevSecOps for Containers
Переглядів 117Місяць тому
Containers can be a powerful DevOps tool to greatly improve the consistency and scalability of your environment. But how do we establish visibility and security in our containers without excessive overhead? We’ll start with an overview of the security challenges posed by containers, and how those can be magnified if we aren’t doing DevOps right. Next, we’ll go over DevSecOps best practices for ...
The Yin and Yang of Generative AI in Cybersecurity Opportunities and Challenges
Переглядів 131Місяць тому
The rapid advancements in Generative AI have opened up a new frontier in cybersecurity, presenting both unprecedented opportunities and daunting challenges. This presentation aims to equip attendees with the critical knowledge and tools needed to navigate the evolving threat landscape shaped by the rise of AI-powered cyber attacks. The session will delve into the dark side of Generative AI, sho...
A Needle in a Haystack How to Find a Threat Hidden in Over 6 Billion Logs Per Day
Переглядів 112Місяць тому
A Needle in a Haystack How to Find a Threat Hidden in Over 6 Billion Logs Per Day
Adding functionality to the AzureRM Provider for SecOps
Переглядів 55Місяць тому
Adding functionality to the AzureRM Provider for SecOps
Unpacking the Psycho Cyber IAM Kill Chain
Переглядів 113Місяць тому
Unpacking the Psycho Cyber IAM Kill Chain
When Cloud Encryption Matters From Another Layer of Access Control to a False Sense of Security
Переглядів 100Місяць тому
When Cloud Encryption Matters From Another Layer of Access Control to a False Sense of Security
Exploring Identity Integrations between the Three CSPs and their Managed Kubernetes Offerings
Переглядів 71Місяць тому
Exploring Identity Integrations between the Three CSPs and their Managed Kubernetes Offerings
Best Practices for How to Manage All Your Access from the Cloud
Переглядів 509Місяць тому
Best Practices for How to Manage All Your Access from the Cloud
HANDS-ON WORKSHOP | Making the Switch to Azure Monitor Agent: Aviata Chapter 6
Переглядів 203Місяць тому
HANDS-ON WORKSHOP | Making the Switch to Azure Monitor Agent: Aviata Chapter 6
HANDS-ON WORKSHOP | Centralizing Cross-Cloud Security Events: Aviata Chapter 5
Переглядів 180Місяць тому
HANDS-ON WORKSHOP | Centralizing Cross-Cloud Security Events: Aviata Chapter 5
HANDS-ON WORKSHOP | Attack and Detect Kubernetes: Aviata Chapter 4
Переглядів 2982 місяці тому
HANDS-ON WORKSHOP | Attack and Detect Kubernetes: Aviata Chapter 4
HANDS-ON WORKSHOP | Transitioning to Containerization: Aviata Chapter 3
Переглядів 3044 місяці тому
HANDS-ON WORKSHOP | Transitioning to Containerization: Aviata Chapter 3
Defending Against Path Traversal Attacks
Переглядів 2835 місяців тому
Defending Against Path Traversal Attacks
Centralizing Cloud Logs and Events with Microsoft Sentinel
Переглядів 8355 місяців тому
Centralizing Cloud Logs and Events with Microsoft Sentinel
🎉
Thanks for uploading this free workshop!
Other than in the Infosec webinars, podcasts or seminars;; no where I find security is a factor for consideration. Just look into any job forums or opportunity, you'll find 100 opportunities for a outdated tools admin but security is still a afterthought.
That was the most lame answer ever why you would choose sentinel. You basically just said you should only use sentinel if you are all in on the Microsoft stack and then moved on to the rest of the presentation. Sentinel is awesome even if you are not using any other Microsoft service. Down voting.
can't really see. the resolution is so bad.
I use a tool that helps with so many points you mentioned - ArmorCode - normalizes across scanners and internal data sources like CMDB + Reprioritizes based on context of internal systems + Automates manual remediation tasks + Tailored reports to various stakeholders. Check it out!
this is a big help but can you have a session where you filter the logs from the aws side before sending it to sentinel? is it even possible? how?
Appreciate the workshop. Much appreciated!
Thanks for the free resources! Great talk and walkthrough.
Great content, thanks Jon!
03:00 - The moment I read/heard about this video my immediate thought was "Er, just use prepared statements?", and wondered if there was going to be more than that to this video. I'll watch the rest now :) . Although I do note that in *PERL*, the last time I did that years ago, it was a bit of a pain if you had a use case where you wanted the *same* variable to be bound in more than one place in the statement. You couldn't do that and the workaround I found was to just copy the value into a temporary variable and reference *that* in the 2nd use (and so on with second temporary for a 3rd use etc).
Good old Perl ;) Perl DBI used to "simular" prepared statements for MySQL pre 4.0.
Great
Studying for GCFR now
Great stuff, Brandon!
Thanks Serge, I'm enjoying the content!
ah, declare -f ! That solves a mystery. Thanks Brandon!
✌️ 'Promo SM'
Where can i find the repo with the files?
Where can i find the manifests ?
Thank You Brandon
Sounds like he's in tunnel of water.
Clearly explained and did not put me to sleep. Quite a feat for a very dry subject.
please do you teach powershell? i really enjoyed your teaching you are a great teacher, you should do more teachings smiles
So why doesn't Terraform apply catch the manually created Security Group before and after the --refresh-only?
Excellent presentation.
This conversation was great. Thank you.
This was awesome!! You mentioned providing access to your slides; however, I don't see any links for accessing them... --A
Thank you, this was well presented and easy to follow.
when are you gonna post again?
I took SEC588 with some engineers and architects from Sketchers. A very impressive group that knows their stuff! Thanks for the interview.
Are there any prerequisites for this course? I have a background in web development and am interested.
Understanding of OWASP Top 10 vulnerabilities
Thank you for this presentation. Really good quality.
this is awesome, really need some more videos on Azure sentinel.
Thank you for uploading this! This is exactly the kind of work I hope to be doing once I graduate
W mans
Maybe setting up a script on the server that will digest the tail of the log every minute or so. Then report it to the SEIM. If there are indicators then store the verbose log and kick off an alert.
Remarkable presentation.
Excellent one Shaun.This just keeps getting interesting 😎
blurred images. could not see any of the demo clearly.
The only step missing the documentation is to enable Security Hub before we can go to the summary page.
Great presentation !
I find this section (⚠2:45-3:50) VERY important.😐
11:35-12:05 I'm glad you interpreted what recommendations or guidances are because people generally tend to not understand that. It's not law. It's a tested best practice or method to ASSIST you towards your goals successfully or with excellence.
thanks keep going we are listening
good session and very helpful.
Interesting perspective. The notes suggest the course eventually teaches the use of terraform to secure cloud environments. Why was terraform chosen over using the native IAC services for each provider?
That audio was killing me thanks to that person that stepped in and told him there was a problem
That's something fresh. Amazing!
Thank you for this video! I didn't know the PuTTy Agent needed to run in the background to successfully connect.
Great talk love the Pet's analogy