The Azure Cloud Security Pentesting Skills You NEED!
Cloud Security Podcast28 Elo 2023

The Azure Cloud Security Pentesting Skills You NEED!

Karl Fosaaen, the author of Penetration Testing "Azure for Ethical Hacker" and the VP of Research at NetSPI, came as a guest to share why the penetration Test of a Web Application hosted on Azure Cloud in 2023 is quite different to just a simple/traditional web app pentesting and the skills you need to pentest Azure environments. Cloud Penetration testing is misunderstood to be just config review in Microsoft Azure Cloud just like in AWS and Google Cloud. In this video, we have Karl Fosaaen was kind enough to answer the following questions and methods.


Episode YouTube: ⁠ ⁠⁠⁠Video Link⁠⁠⁠⁠⁠⁠


Host Twitter: Ashish Rajan (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@hashishrajan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠)

Guest Socials: Karl's Linkedin (⁠⁠⁠⁠Karl Fosaaen)

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠


Spotify TimeStamp for Interview Question

(00:00) Introduction

(02:32) A bit about Karl Fosaaen

(03:26) How is pentesting in Azure different from AWS?

(04:35) Cloud pentesting is not just config review

(05:42) Cloud pentesting vs Network pentesting

(06:25) Cloud Pentest - Next evolution of Network Pentest?

(07:14) Boundaries of cloud pentesting

(09:07) Do you need prior approval for Azure Pentest?

(09:32) Working with Microsoft Security Research Centre

(10:35) Process of pentesting in Azure

(11:57) Low hanging fruits to start off with!

(13:37) How to persist and escalate?

(14:58) Managed Identities in Azure

(16:23) Impact of peripheral services to Azure

(18:33) Scale of deployments in Azure

(21:02) Getting access to permissions for Azure Entra

(22:36) Scaling your pentest tools

(23:34) TTPs or Matrix you can use

(25:30) Getting into Azure Pentesting

(26:56) Transitioning from network to azure pentesting

(28:37) Connect with Karl


Resources:

The NetSPI Blog to learn more about offensive cloud security

Mitre - Cloud Attack Matrix

ATRM

Karl's Book - Penetration Testing Azure for Ethical Hackers: Develop practical skills to perform pentesting and risk assessment of Microsoft Azure environments

See you at the next episode!

Jaksot(344)

Manage Privileged Access for Kubernetes & Cloud

Manage Privileged Access for Kubernetes & Cloud

In this episode of the Virtual Coffee with Ashish edition, we spoke with Sakshyam Shah from Teleport Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv Host...

22 Huhti 202244min

How to become a Cloud Native Security Engineer

How to become a Cloud Native Security Engineer

In this episode of the Virtual Coffee with Ashish edition, we spoke with Pushkar Joglekar, Sr. Security Engineer, VMWare Tanzu Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cl...

10 Huhti 202244min

Service Mesh Security EXPLAINED!

Service Mesh Security EXPLAINED!

In this episode of the Virtual Coffee with Ashish edition, we spoke with William Morgan, ex Twitter, CEO Buoyant Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypo...

3 Huhti 202250min

Scaling a Practical AWS Asset Management Program

Scaling a Practical AWS Asset Management Program

In this episode of the Virtual Coffee with Ashish edition, we spoke with Jasmine Henry & George Tang from JupiterOne Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecurit...

27 Maalis 202240min

Threat Hunting in AWS

Threat Hunting in AWS

n this episode of the Virtual Coffee with Ashish edition, we spoke with Eliav Livneh , Lead Security Researcher at Hunters Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.clouds...

20 Maalis 202243min

What is SBOM, iBOM?

What is SBOM, iBOM?

In this episode of the Virtual Coffee with Ashish edition, we spoke with Barak Schoster Goihman, Senior Director, Chief Architect at Palo Alto Networks (BridgeCrew) Episode ShowNotes, Links and Transc...

13 Maalis 202239min

Security for AI/ML Models in AWS

Security for AI/ML Models in AWS

In this episode of the Virtual Coffee with Ashish edition, we spoke with Mike Chambers @mikechambers, AWS Hero AI/ML Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuri...

6 Maalis 202254min

Building Google Cloud Security Products

Building Google Cloud Security Products

In this episode of the Virtual Coffee with Ashish edition, we spoke with Sunil Potti @sunilpotti VP/GM, Google Cloud Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecurit...

3 Maalis 202247min