Google Cloud Security Pentesting Methodology

Google Cloud Security Pentesting Methodology

Penetration Test of a Web Application hosted on Google Cloud in 2023 is quite different to just a simple/traditional web app pentesting.
Cloud Penetration testing is misunderstood to be just config review in Google Cloud. In this video, we have Kat Traxler who is a cloud security researcher, SANS Course author and has worked in the Google Cloud space to even build open source tools that can be used to perform cloud security testing.


Episode YouTube: ⁠ ⁠⁠⁠Video Link⁠⁠⁠⁠⁠⁠


Host Twitter: Ashish Rajan (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@hashishrajan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠)

Guest Socials: Kat Traxler (⁠⁠ Kat Traxler's Linkedin ⁠⁠)

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠


Spotify TimeStamp for Interview Question

(00:00) Introduction

(04:17) A bit about Kat Traxler

(05:56) Pentesting in GCP vs AWS

(08:07) Config review vs cloud pentesting

(09:24) Cloud pentest vs Traditional Pentest

(10:28) Starting to do GCP pentesting

(12:35) Common services used in GCP

(14:10) Low hanging fruits in GCP

(15:25) What are default service accounts?

(17:52) You may already have google cloud

(20:00) How to persist access in Google Cloud?

(21:56) Shared responsibility in GCP

(24:01) Common TTPs in GCP

(28:05) Is there SSRF in GCP?

(30:19) Open source tools for cloud pentest

(33:59) Fun questions


Resources that Kat shared during the episode

See you at the next episode!

Jaksot(344)

AI Vulnerability Management: Why You Can't Patch a Neural Network

AI Vulnerability Management: Why You Can't Patch a Neural Network

Traditional vulnerability management is simple: find the flaw, patch it, and verify the fix. But what happens when the "asset" is a neural network that has learned something ethically wrong? In this e...

13 Tammi 41min

Why Backups Aren't Enough & Identity Recovery is Key against Ransomware

Why Backups Aren't Enough & Identity Recovery is Key against Ransomware

Think your cloud backups will save you from a ransomware attack? Think again. In this episode, Matt Castriotta (Field CTO at Rubrik) explains why the traditional "I have backups" mindset is dangerous....

16 Joulu 202537min

How to secure your AI Agents: A CISOs Journey

How to secure your AI Agents: A CISOs Journey

Transitioning a mature organization from an API-first model to an AI-first model is no small feat. In this episode, Yash Kosaraju, CISO of Sendbird, shares the story of how they pivoted from a traditi...

9 Joulu 202554min

AI-First Vulnerability Management: Should CISOs Build or Buy?

AI-First Vulnerability Management: Should CISOs Build or Buy?

Thinking of building your own AI security tool? In this episode, Santiago Castiñeira, CTO of Maze, breaks down the realities of the "Build vs. Buy" debate for AI-first vulnerability management.While b...

4 Joulu 20251h 1min

SIEM vs. Data Lake: Why We Ditched Traditional Logging?

SIEM vs. Data Lake: Why We Ditched Traditional Logging?

In this episode, Cliff Crosland, CEO & co-founder of Scanner.dev, shares his candid journey of trying (and initially failing) to build an in-house security data lake to replace an expensive traditiona...

2 Joulu 202546min

How to Build Trust in an AI SOC for Regulated Environments

How to Build Trust in an AI SOC for Regulated Environments

How do you establish trust in an AI SOC, especially in a regulated environment? Grant Oviatt, Head of SOC at Prophet Security and a former SOC leader at Mandiant and Red Canary, tackles this head-on a...

18 Marras 202542min

Threat Modeling the AI Agent: Architecture, Threats & Monitoring

Threat Modeling the AI Agent: Architecture, Threats & Monitoring

Are we underestimating how the agentic world is impacting cybersecurity? We spoke to Mohan Kumar, who did production security at Box for a deep dive into the threats of true autonomous AI agents.The c...

11 Marras 202547min

AI is already breaking the Silos Between AppSec & CloudSec

AI is already breaking the Silos Between AppSec & CloudSec

The silos between Application Security and Cloud Security are officially breaking down, and AI is the primary catalyst. In this episode, Tejas Dakve, Senior Manager, Application Security, Bloomberg In...

4 Marras 20251h 11min