Google Cloud Hacking Red Team Perspective!
Cloud Security Podcast2 Elo 2023

Google Cloud Hacking Red Team Perspective!

Google cloud hacking or pentesting is very different to other popular cloud service providers like aws or azure. In this episode we had Shannon McHale (Mandiant now Google Cloud) to talk about how she approaches pentesting a google cloud environment and how you can too.


Episode YouTube: ⁠ Video Link⁠⁠⁠


Host Twitter: Ashish Rajan (⁠⁠⁠⁠⁠⁠⁠@hashishrajan⁠⁠⁠⁠⁠⁠⁠)

Guest Socials: Shannon McHale's Linkedin ⁠⁠⁠⁠(⁠Shannon's Linkedin⁠)

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp⁠⁠⁠⁠⁠⁠⁠


Spotify TimeStamp for Interview Questions

A word from our sponsors - you can visit them on ⁠⁠⁠⁠⁠⁠⁠snyk.io/csp⁠⁠⁠⁠⁠⁠⁠


(00:00) Introduction

(03:38) A bit about Shannon McHale

(05:31) What is Red Teaming?

(06:42) Red Teaming in the Cloud

(07:50) Methodology behind Red Teaming

(09:32) Pentesting in Goole Cloud

(10:28) Low hanging fruits in Google Cloud

(14:36) GCP storage

(16:09) Red Team Assessment in Google Cloud

(17:08) The importance of Metadata

(18:17) Recommendations for Blue Teamers

(22:03) How to get started in Red Teaming?

(26:06) Tools or Research that stood out for Shannon

(27:42) GCP Resources that can be exposed

(29:15) Resources to learn about Cloud Red Teaming

(30:37) The Fun Questions


These are some of the resources Shannon found helpful to learn about Pentesting in Cloud along with her own GitHub link

See you at the next episode!

Jaksot(344)

Secret Management for Modern Apps Explained

Secret Management for Modern Apps Explained

In this episode of the Virtual Coffee with Ashish edition, we spoke with Dylan Ayrey (@insecurenature) is a Professional Hacker and Co-Founder of Truffle Security (@trufflesec) Episode ShowNotes, Link...

16 Tammi 202248min

CISO in a Cloud World in 2022 - Stu Hirst

CISO in a Cloud World in 2022 - Stu Hirst

In this episode of the Virtual Coffee with Ashish edition, we spoke with Stu Hirst (Linkedin-Stu Hirst) is the Chief Information Security Officer (CISO) of Trustpilot (@Trustpilot). Episode ShowNotes,...

12 Tammi 202239min

UK Financial Regulators monitoring Cloud Providers Closely

UK Financial Regulators monitoring Cloud Providers Closely

Cloud Security News this week 12 Jan 2022 UK’s financial regulators - The Prudential Regulation Authority is looking to increase it’s monitoring of Cloud providers like AWS, Azure and Google Cloud. ...

12 Tammi 20224min

Building Modern Identity (IAM) Roadmap for Cloud

Building Modern Identity (IAM) Roadmap for Cloud

In this episode of the Virtual Coffee with Ashish edition, we spoke with Fred Wilmot (@fewdisc) is an ex-Veteran and Chief Information Security Officer (CISO) of JumpCloud (@JumpCloud). Episode ShowNo...

9 Tammi 202248min

Google invests in Security + Microsoft's Log4Shell Update

Google invests in Security + Microsoft's Log4Shell Update

Cloud Security News this week 5 Jan 2022 Google has acquired security orchestration, automation and response (SOAR) provider, Siemplify. Neither company has disclosed any amounts however sources in...

5 Tammi 20225min

Building Scalable Authorization in Cloud Native Apps

Building Scalable Authorization in Cloud Native Apps

In this episode of the Virtual Coffee with Ashish edition, we spoke with Or Weis (@OrWeis) co-founder and CEO of Permit.io (@permit_io). Episode ShowNotes, Links and Transcript on Cloud Security Podca...

2 Tammi 202250min

The Latest with Log4J

The Latest with Log4J

Cloud Security News this week 22 December 2021 Most folks in cybersecurity have been consumed with all things Log4shell with a CVSS score of 10, since last week. Check out last week’s episode or our...

22 Joulu 20213min

Log4j - How the Cloud Providers responded!

Log4j - How the Cloud Providers responded!

Cloud Security News this week 15 December 2021 This week, the world of cybersecurity has been consumed by the Log4Shell vulnerability. So whats it all about. Log4j is a Java library for logging er...

15 Joulu 20212min