The Azure Cloud Security Pentesting Skills You NEED!
Cloud Security Podcast28 Elo 2023

The Azure Cloud Security Pentesting Skills You NEED!

Karl Fosaaen, the author of Penetration Testing "Azure for Ethical Hacker" and the VP of Research at NetSPI, came as a guest to share why the penetration Test of a Web Application hosted on Azure Cloud in 2023 is quite different to just a simple/traditional web app pentesting and the skills you need to pentest Azure environments. Cloud Penetration testing is misunderstood to be just config review in Microsoft Azure Cloud just like in AWS and Google Cloud. In this video, we have Karl Fosaaen was kind enough to answer the following questions and methods.


Episode YouTube: ⁠ ⁠⁠⁠Video Link⁠⁠⁠⁠⁠⁠


Host Twitter: Ashish Rajan (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@hashishrajan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠)

Guest Socials: Karl's Linkedin (⁠⁠⁠⁠Karl Fosaaen)

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠


Spotify TimeStamp for Interview Question

(00:00) Introduction

(02:32) A bit about Karl Fosaaen

(03:26) How is pentesting in Azure different from AWS?

(04:35) Cloud pentesting is not just config review

(05:42) Cloud pentesting vs Network pentesting

(06:25) Cloud Pentest - Next evolution of Network Pentest?

(07:14) Boundaries of cloud pentesting

(09:07) Do you need prior approval for Azure Pentest?

(09:32) Working with Microsoft Security Research Centre

(10:35) Process of pentesting in Azure

(11:57) Low hanging fruits to start off with!

(13:37) How to persist and escalate?

(14:58) Managed Identities in Azure

(16:23) Impact of peripheral services to Azure

(18:33) Scale of deployments in Azure

(21:02) Getting access to permissions for Azure Entra

(22:36) Scaling your pentest tools

(23:34) TTPs or Matrix you can use

(25:30) Getting into Azure Pentesting

(26:56) Transitioning from network to azure pentesting

(28:37) Connect with Karl


Resources:

The NetSPI Blog to learn more about offensive cloud security

Mitre - Cloud Attack Matrix

ATRM

Karl's Book - Penetration Testing Azure for Ethical Hackers: Develop practical skills to perform pentesting and risk assessment of Microsoft Azure environments

See you at the next episode!

Jaksot(344)

HOW TO BUILD A CLOUD SECURITY PROGRAM - MEDIA INDUSTRY

HOW TO BUILD A CLOUD SECURITY PROGRAM - MEDIA INDUSTRY

Cloud Security Podcast - This month we are talking about "Cloud Security - the Leadership View" and first up on this series, we spoke to Bianca Lankford (Bianca's Linkedin) about what does it take to...

4 Maalis 202334min

How to Accelerate your AWS Security Maturity in 2023

How to Accelerate your AWS Security Maturity in 2023

Cloud Security Podcast - This month we are talking about "Building on the AWS Cloud" and next up on this series, we spoke to Chad Lorenc (Chad's Linkedin) about AWS Security Reference Architecture, C...

25 Helmi 202356min

How to Build AWS Multi-Account Infrastructure with Security and Speed

How to Build AWS Multi-Account Infrastructure with Security and Speed

Cloud Security Podcast - This month we are talking about "Building on the AWS Cloud" and next up on this series, we spoke to Patrick Sanders (Patrick's Linkedin) & Jospeh Kjar (Joseph's Linkedin), Sn...

21 Helmi 202355min

HOW TO GET FEDRAMP CERTIFIED IN AWS CLOUD

HOW TO GET FEDRAMP CERTIFIED IN AWS CLOUD

Cloud Security Podcast - This month we are talking about "Building on the AWS Cloud" and next up on this series, we spoke to Alexis Robinson (Alexis's Linkeidn), Senior Manager, Regulatory Compliance...

14 Helmi 202357min

HOW TO BUILD A CLOUD SECURITY PROGRAM WITH CONTAINERS

HOW TO BUILD A CLOUD SECURITY PROGRAM WITH CONTAINERS

Cloud Security Podcast - This month we are talking about "Building on the AWS Cloud" and next up on this series, we spoke to Mrunal Shah (Mrunal's Linkedin), Head of Container Security at Warner Bros...

5 Helmi 202344min

AWS Cloud Penetration Testing Explained with Example

AWS Cloud Penetration Testing Explained with Example

Cloud Security Podcast - This month we are talking about "Breaking the AWS Cloud" and next up on this series, we spoke to Seth Art (Seth's Linkedin) Cloud Penetration Testing Lead (Principal) at Bish...

30 Tammi 202353min

AWS Goat - Cloud Penetration Testing

AWS Goat - Cloud Penetration Testing

Cloud Security Podcast - This month we are talking about "Breaking the AWS Cloud" and next up on this series, we spoke to Nishant Sharma (Nishant's Linkedin), Director, Lab Platform, INE. If you have...

24 Tammi 202353min

Getting Started with Hacking AWS ECS

Getting Started with Hacking AWS ECS

Cloud Security Podcast - This month we are talking about "Breaking the AWS Cloud" and next up on this series, we spoke to Gafnit Amiga (Gafnit's Linkedin), VP of Security Research at Lightspin who re...

12 Tammi 202332min