![AppSecEngineer](/img/default-banner.jpg)
- 307
- 238 884
AppSecEngineer
United States
Приєднався 7 жов 2020
Exclusive Full-Stack Security training from we45. Learn with hands-on labs & get certified in DevSecOps, Cloud Security, Kubernetes Security & more.
How to Exploit Docker Containers with a Volume Mount Attack | Container Security | Part 8
Here's the next episode in our AppSecEngineer Hands-On Labs Walkthrough Series!
In this series, we’ll start by diving deep into Docker - understanding what it is and why it’s become an essential tool in modern software development.
In this video, we dive into one of the most critical Docker container attacks: the Volume Mount attack. Learn how to execute a container breakout by mounting the host filesystem to a Docker container, even as a non-root user. We'll walk through the entire process, from validating user access to exploiting the host machine's root directory.
Get the K8S & Container Security Collection: www.appsecengineer.com/containers-kubernetes-security-collection
Get the Pro Annual subscription: www.appsecengineer.com/pricing
Don't forget to hit the subscribe button and click the bell icon so you don't miss any of our upcoming episodes.
#docker #container #containersecurity #cybersecurity #appsec #infosec #infosectraining #developer #securityengineer #applicationsecurit
In this series, we’ll start by diving deep into Docker - understanding what it is and why it’s become an essential tool in modern software development.
In this video, we dive into one of the most critical Docker container attacks: the Volume Mount attack. Learn how to execute a container breakout by mounting the host filesystem to a Docker container, even as a non-root user. We'll walk through the entire process, from validating user access to exploiting the host machine's root directory.
Get the K8S & Container Security Collection: www.appsecengineer.com/containers-kubernetes-security-collection
Get the Pro Annual subscription: www.appsecengineer.com/pricing
Don't forget to hit the subscribe button and click the bell icon so you don't miss any of our upcoming episodes.
#docker #container #containersecurity #cybersecurity #appsec #infosec #infosectraining #developer #securityengineer #applicationsecurit
Переглядів: 43
Відео
How to secure Docker: Explore Attack Vectors and Mitigations | Container Security | Part 8
Переглядів 75День тому
Here's the next episode in our AppSecEngineer Hands-On Labs Walkthrough Series! In this series, we’ll start by diving deep into Docker - understanding what it is and why it’s become an essential tool in modern software development. In this video, we dive deep into the security aspects of Docker. We’ll explore various ways to attack Docker containers and implementations, starting with a high-lev...
How to Pull, Run, and Manage Docker Images | Container Security | Part 7
Переглядів 6814 днів тому
Here's the next episode in our AppSecEngineer Hands-On Labs Walkthrough Series! In this series, we’ll start by diving deep into Docker - understanding what it is and why it’s become an essential tool in modern software development. In this video, we'll walk you through the essential steps of pulling Docker images from Docker Hub, running containers, and managing them with ease. Whether you're n...
Why Docker - Key Advantages Every Developer Should Know | Container Security | Part 6
Переглядів 4314 днів тому
Here's the next episode in our AppSecEngineer Hands-On Labs Walkthrough Series! In this series, we’ll start by diving deep into Docker - understanding what it is and why it’s become an essential tool in modern software development. In this video, we break down the major advantages of using Docker, from consistency and efficiency to scalability and security. Whether you're new to containerizatio...
Docker Basics: Must-Know Commands for Beginners | Container Security | Part 5
Переглядів 3021 день тому
Here's the next episode in our AppSecEngineer Hands-On Labs Walkthrough Series! In this series, we’ll start by diving deep into Docker - understanding what it is and why it’s become an essential tool in modern software development. This video breaks down key Docker Commands. By the end of the series, you'll have a comprehensive understanding of Docker, the ability to secure your containers, and...
Webinar: Secure by Design - Across the stack
Переглядів 151Місяць тому
Missed our live webinar last month? Watch the recording now! Abhay Bhargav will delve into the intricacies of designing security into every layer of your technology stack while aligning with CISA's Secure by Design principles. Key Takeaways: - Explore the Secure by Design principles promoted by CISA and how they can be applied to enhance your security posture. - Learn how to integrate security ...
Docker Volume - Key Features and Benefits | Container Security | Part 4
Переглядів 86Місяць тому
Welcome to the AppSecEngineer Hands-On Labs Walkthrough Series! In this video, we delve into Docker Volumes, a crucial persistent storage mechanism for managing data in Docker containers. Learn about the key characteristics of Docker Volumes, including their independence from the container lifecycle, isolation from the container file system, and ability to be shared among multiple containers. G...
4 Common Mistakes in Cloud Security and How to Fix Them
Переглядів 87Місяць тому
In this video, Abhay Bhargav shares the four common mistakes that can cause your cloud applications to be insecure and how you can address them using tools provided by the cloud itself. Key Takeaways: * Ensure proper access control and identity management to prevent high-privilege compromises. * Implement robust monitoring to detect and address security issues early. * Use cloud tools for effec...
Where to Securely Store JWTs: Cookies, Local Storage, or Session Storage?
Переглядів 82Місяць тому
Join Abhay Bhargav as he dives into the recent twitter(X) debate of where to store JSON Web Tokens (JWTs). Learn the pros and cons of storing JWTs in cookies, local storage, and session storage. Understand the potential security risks, including CSRF and XSS vulnerabilities, and discover the best practices to keep your applications secure. Don't miss out on this crucial security insight! #JWT #...
Webinar: Leveraging Semgrep and Static Analysis for Paved Roads and Secure Defaults
Переглядів 69Місяць тому
Missed our live webinar last month? Watch the recording now! In this session, he'll explore how SemGrep can help you establish secure coding practices and enforce policy compliance across your codebase. Learn how to create "paved roads" - pre-approved paths that make it easy for developers to do the right thing - and set secure defaults to minimize vulnerabilities from the start. Whether you're...
Image vs Container: Key Differences Explained | Container Security | Part 3
Переглядів 51Місяць тому
Welcome to the AppSecEngineer Hands-On Labs Walkthrough Series! In this video, let's dive into the core distinctions between Docker images and containers in our latest video. Understand how images serve as immutable blueprints to create multiple containers and how containers act as the running instances of these images. Learn about the lifecycle of containers, from creation to deletion, and exp...
7 Steps to Developing Secure-by-Design Software
Переглядів 80Місяць тому
7 Steps to Developing Secure-by-Design Software
What Are Containers | Container Security Series | Part 2
Переглядів 86Місяць тому
What Are Containers | Container Security Series | Part 2
DevSecOps Certification by AppSecEngineer
Переглядів 181Місяць тому
DevSecOps Certification by AppSecEngineer
Introduction to Docker | Container Security Series | Part 1
Переглядів 179Місяць тому
Introduction to Docker | Container Security Series | Part 1
Implementing Secure by Design Principles in AWS | AWS Security
Переглядів 235Місяць тому
Implementing Secure by Design Principles in AWS | AWS Security
Webinar: 2 Stories in Cloud Security - An Exploration of Attack Detect Defense on the Cloud
Переглядів 1302 місяці тому
Webinar: 2 Stories in Cloud Security - An Exploration of Attack Detect Defense on the Cloud
How to Detect Network Security Attacks with AWS VPC Mirroring | AWS Security
Переглядів 2662 місяці тому
How to Detect Network Security Attacks with AWS VPC Mirroring | AWS Security
How to Catch Failed SSH Logins with AWS Cloudwatch | AWS Security
Переглядів 2462 місяці тому
How to Catch Failed SSH Logins with AWS Cloudwatch | AWS Security
DevSecOps Masterclass 2024 Edition - BlackHat USA
Переглядів 1312 місяці тому
DevSecOps Masterclass 2024 Edition - BlackHat USA
Attacking & Defending AWS, Azure & GCP Cloud Applications - BlackHat USA 2024
Переглядів 1382 місяці тому
Attacking & Defending AWS, Azure & GCP Cloud Applications - BlackHat USA 2024
Essential Tools for Effective Cloud Security Incident Response
Переглядів 953 місяці тому
Essential Tools for Effective Cloud Security Incident Response
Track Your Team's Training Progress on AppSecEngineer
Переглядів 824 місяці тому
Track Your Team's Training Progress on AppSecEngineer
Webinar: Rapid Threat Modeling with GenAI and LLMs
Переглядів 9534 місяці тому
Webinar: Rapid Threat Modeling with GenAI and LLMs
Attacking Azure Virtual Machines | Live Code
Переглядів 1565 місяців тому
Attacking Azure Virtual Machines | Live Code
All About the Secure Coding Collection | AppSecEngineer
Переглядів 1285 місяців тому
All About the Secure Coding Collection | AppSecEngineer
AWS Servers Can Be Compromised Using GitHub??
Переглядів 785 місяців тому
AWS Servers Can Be Compromised Using GitHub??
Open Source Libraries Can Kill Your Supply Chain Security
Переглядів 895 місяців тому
Open Source Libraries Can Kill Your Supply Chain Security
How to learn Cloud Security? | Cloud Security Expert breaks it down step-by-step
Переглядів 9946 місяців тому
How to learn Cloud Security? | Cloud Security Expert breaks it down step-by-step
What is CSRF? How does it work on Ruby on Rails applications? | AppSec Expert discusses
Переглядів 3056 місяців тому
What is CSRF? How does it work on Ruby on Rails applications? | AppSec Expert discusses
🫶
thanks!
So am I the only one who's like concerned that I'm not getting calls about my automobile insurance for an automobile I do not own so maybe Putin told them you need to start working for me remember I let you do whatever the hell you want the entire world except for of course us here in Russia so what are they working on other than this scam
Bro took only a few seconds to explain the whole thing
Thanks🎉🎉
🧏🏻♂️☯️🪬🌏♻️✝️🌌
Very good guide, thank you. You are a good teacher.
Thank you ☺️
Bro, if I use environment variables, once the attacker gets RCE, they will possibly access environment variables. So is it best practices?
It’s very difficult to not use env-vars itself. The key is to ideally use env-vars sparingly. For example, you’ll have to probably configure a secrets management solution to handle app secrets, but the secret to access the secrets management solution will probably need to be an env-var. however, this is still lower risk because one can secure the secrets management solution with access control, audit trails etc Env-vars do have an inherent risk, but reducing the blast radius of the secret in the env-var is more important
Besides, rce will generally mean that the app env is completely compromised. Even if you had that secret in a config file, it would still be pwned
thanks for this video. keep sharing your knowledge.
Thank you! We will!
Provide some resources to learn AI Security
hey, you can learn with our AI & LLM Security Collection on AppSecEngineer : www.appsecengineer.com/ai-llm-security-collection
2 things : 1. its going to be hard to pool all the attributes from various apps and 2nd like you said people will start asking some list, set operations on permissions data . ideally its outside the scope of auth engine but since it holds all relevant data clients will ask!
How about API only applications, is there anything specific we have to do?
CSRF is typically not so much of an issue for api applications. Csrf happens because the browser submits cookies in the request sometimes without the user’s knowledge. In the case of apis Csrf can only happen when there’s a misconfigured frontend or if the api leverages cookies (which is not typical)
When the course will start....
Hey, this course is already available for Free on our UA-cam channel. Check out the link here: ua-cam.com/video/9bMqK_RQrhQ/v-deo.html
you have no clue
How does using the latest version of your dependencies lead to INsecurities, assuming that hackers didn't compromise the supply chain?
It’s usually best to use the latest version of a software/library that’s been tested and is known to be secure. Assuming there’s an even more recent patch, it may be that that version has insecurities not yet discovered. As for what an attacker can do, they can release a software to the public registry with the same name but a higher version number, and that tricks the pkg manager to install that version.
Nice content! Consider reducing background music volume. A little distracting
Promo-SM
Hi, this approach seems very interesting but different from what I have seen from UA-cam. For example, you didn't mention any certification like Azure,AwS, etc. Can you please clarify this? Also, how long approximately does it take to complete the program on your platform? Thank you
Thanks for your question. It’s a good one. I am not against certs, but specifically I am not a huge fan of certs either. Specifically not a huge fan of certs that are largely MCQs and have no practical component to it (except Kubernetes) Our platform is a continuous learning platform. So there’s no real “finishing it” but to get a decent competence in each cloud env I feel it can be done in 16 hours
Hi Abhay! Fantastic video! This is great stuff, could we also have videos on how one can deploy commonly used apps insecurely on cloud and how we can make it more secure? What I mean is going through the security life journey of an app deployed on cloud on different spaces like Lambda functions, App runner, Ampplify or even some of the new stuff like AWS codestar. And showing how a backend-front end app that looks very secure can be easily exploited ( as web apps are the most common thing now)
Sure, we have these labs anyway. Will take this into account
👍
Could you please create vedio on other grant types aswell
Hey, we'll surely do that.
I want to become cloud security engineering, but I lack a degree or IT background. Would it be beneficial for me to first pursue a role in cybersecurity engineering as a way to achieve cloud security engineer. I'd appreciate some guidance on the best path forward given my circumstances. Thank you for your help.
This is Abhay here. I am a commerce graduate and don’t have an IT degree. What I suggest to anyone (regardless of degree) is that you need to learn how to build some apps (nothing major), understand programming and learn how to deploy these apps. Once you go 2 out of 3 of these things, you can easily start scaling your learning of cloud. You can do it!
@@AppSecEngineer thank you for your guidance, sir.
@@AppSecEngineerHi Abhay, kindly explain what you meant by deploying apps. Thank you
Awesome video. Bro how much preparing do you do for videos? Coding on the fly is sweet - also what plugins are you using to provide you that superb auto completed?
Thank you 😊 The only prep I did for this video was approx 5 mins just before making the video. Just to identify what features I need to build and write security tests for. I use GitHub copilot and cursor for autocomplete in most cases
@@AppSecEngineer Thank you and that’s impressive but this ain’t the first time I’ve seen you cook things up on the fly. What’s a good way to chat with you more effectively?
Thanks 😊 LinkedIn or twitter messages are the easiest way to discuss with me. Please connect on LinkedIn and we can talk
How is it different from other csrf attacks?
It’s not really different. The bigger thing to focus on here is how a Ruby on Rails app is rendered vulnerable to csrf and how it can be secured
@@AppSecEngineer got it 👌👍
I love this guy
Thanks 😊 we think he’s pretty awesome as well
Is coding knowledge a prerequisite to become an expert cloud security architect?
Yes, I think being able to understand how systems work from the inside requires knowledge of code. The cloud itself is just a giant set of APIs, so your ability to navigate these APIs is a functional requirement and that requires you to understand code. You may not need to write code everyday or be a software engineer shipping (software) products everyday but you need to understand code, and you need to be able to understand how code is deployed and integrated with other services in the cloud
Is there a video showing how to publish results to jira ?
It’s not there as a video, but you should probably check out their jira plug-in to publish these results to jira as another task plugins.jenkins.io/jira/issues/
Very informative
Thank you 😊
Great explanation. Expecting more videos around image security.
Sure. We’ll keep bringing them to you
Girl! you are such an inspiration
Will they give certificates after completing
Yes they send digital certificates
Bro casually planting ideas in minds of hackers and thinking it's just a normal informative short.
😂
Great content. Thanks! Here is a thing I don't get it. Isn't the private certificate another kind of persistent credentials? Whoever gets it, gets access to the AWS resources right? How is this more secure?
IPsec is a good example of using it both, in IKE-1 phase you have asymmetric keys, and in IKE-2 phase you use symmetric keys... Kinda like best of both worlds.
Yes, most key exchange based cryptographic implementation systems leverage multiple crypto concepts, ranging from asymmetric to symmetric to hashing and HMAC functions
We are using QUIC protocols in our zero trust architecture. And yes, tgeres no such things as zero trust, every component have a trust list kinda like ACLs but for components.
Precisely! Zero trust is low implicit trust. Explicitly defined through things like ACLs bound by strong identity params
Nice video
There's any difference betweek cloud security architect and cloud security engineer
Sure there is! Please check this video to learn about Cloud Security Architect - ua-cam.com/video/jLx4V0nx7lI/v-deo.html
Compare random inputs via brute forcing. You just need a good gpu and bam password stolen.
Not if the password is any good -- which "suggest password" in Chrome, or various password length/content rules like "add numeric digits, make it bigger than X chars" etc ensure. If the password has enough entropy and length (is not just "secret" or "john1998" or something stupid like that), it can't be brute forced if hashed with a good hash algorithm, as it would take millenia. And with hash + salt, you can't precompute the hashes of random inputs and check them against all the passwords you want to break, you need to recompute the hash and check all inputs for every individual password.
@@foljs5858 true!
That's where pass the hash comes to help hackers out:)
And there Realy strong 🧐🤨🤨🤨🤨
But in a another video posted on UA-cam by chad wild cay they said that they were wearing scold masks
The best use case is https where speed and integrity achieved with both.
That’s right. All crypto concepts like symmetric (for data encryption), key exchange and encryption (with asymmetric encryption) and integrity verification with hashing is used with HTTPS
❤❤
Does it ring a bell Scatterd Skull
explain in simple way good one
Thanks!
What do you think would be the best role to come up as if one is looking to be a cloud security architect? Cloud security analyst or cloud security engineer? Thank you, and Merry Christmas.
Thanks for your question. I think cloud security engineer would be a natural fit for this for progression towards cloud security architect
Thanks. Great job. One advice: slow down, add visual words. Do you need to be in the video? It's distrating. Maybe you should appear at intro and at the end. Have visual information with words and designs related to the message. Great niche.❤
Will do. Thanks for the constructive suggestions 👍
Thank you for sharing this information however, we have to be careful what we share even when we're trying to protect our people... My Facebook account was hact and I know what a mess that can lead to... They can actually act as if they were you and do all sorts of misrepresentation of behavior. They basically take over your identity Doing whatever they please. I now have Facebook back to a degree but I'm not trusting of it. All of this technology is wonderful however... Sometimes it certainly seems the old way was better, less penetratable. If you want to cripple something this is certainly the way you would start you attack their bottom line... This certainly has a Domino effect🥵 Perhaps a better way would be fingerprinting... That would be harder to duplicate... Voice wouldn't work because it's too easy to copy these days. Well I'm sure all of the geniuses will figure it out🤔 Hopefully sooner than later😊 I am really so sorry that this has happened ... And I pray that they can correct it.🙏❤
I have interest in cyber security but somehow I got a job as a junior cloud engineer. the question is I want to build my career in security also I was done two internship of 6 month in security analyst in last year I have total 1 year of experience after my graduation in B.E. so is it helpful for my future to work in this field (junior cloud engineer)or should I skip this job after getting a job in security field. I am really confused can you please help me I will be thankful for your guidance.
Hey, thanks so much for leaving a comment here. In my opinion, cloud security is a very hot topic right now and is only likely to get more in-demand in the coming years. However, it’s not an entry level role by any means, and would require some years of experience in the role of, say, a cloud engineer. It might make sense for you to pursue the cloud engineer role for a few years with an emphasis on security. Eventually you could transition completely into a cloud security role. If you want some more clarity on AppSec and Cloud careers, here’s 2 free ebooks we have on our website: AppSec Career Guide - www.appsecengineer.com/e-books/e-book-a-beginners-guide-to-careers-in-appsec Cloud Security Career - www.appsecengineer.com/e-books/cloud-security-careers-a-beginners-guide
Bro explained it in clash of clans terms
Do I need to have programming and coding knowledge to become a App Sec Engineer?
hey, here's a UA-cam shorts by Abhay Bhargav that answers your question. Link - ua-cam.com/users/shortsg_ZWDXAYYeg We hope this helps!