The Azure Cloud Security Pentesting Skills You NEED!

The Azure Cloud Security Pentesting Skills You NEED!

Karl Fosaaen, the author of Penetration Testing "Azure for Ethical Hacker" and the VP of Research at NetSPI, came as a guest to share why the penetration Test of a Web Application hosted on Azure Cloud in 2023 is quite different to just a simple/traditional web app pentesting and the skills you need to pentest Azure environments. Cloud Penetration testing is misunderstood to be just config review in Microsoft Azure Cloud just like in AWS and Google Cloud. In this video, we have Karl Fosaaen was kind enough to answer the following questions and methods.


Episode YouTube: ⁠ ⁠⁠⁠Video Link⁠⁠⁠⁠⁠⁠


Host Twitter: Ashish Rajan (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@hashishrajan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠)

Guest Socials: Karl's Linkedin (⁠⁠⁠⁠Karl Fosaaen)

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠


Spotify TimeStamp for Interview Question

(00:00) Introduction

(02:32) A bit about Karl Fosaaen

(03:26) How is pentesting in Azure different from AWS?

(04:35) Cloud pentesting is not just config review

(05:42) Cloud pentesting vs Network pentesting

(06:25) Cloud Pentest - Next evolution of Network Pentest?

(07:14) Boundaries of cloud pentesting

(09:07) Do you need prior approval for Azure Pentest?

(09:32) Working with Microsoft Security Research Centre

(10:35) Process of pentesting in Azure

(11:57) Low hanging fruits to start off with!

(13:37) How to persist and escalate?

(14:58) Managed Identities in Azure

(16:23) Impact of peripheral services to Azure

(18:33) Scale of deployments in Azure

(21:02) Getting access to permissions for Azure Entra

(22:36) Scaling your pentest tools

(23:34) TTPs or Matrix you can use

(25:30) Getting into Azure Pentesting

(26:56) Transitioning from network to azure pentesting

(28:37) Connect with Karl


Resources:

The NetSPI Blog to learn more about offensive cloud security

Mitre - Cloud Attack Matrix

ATRM

Karl's Book - Penetration Testing Azure for Ethical Hackers: Develop practical skills to perform pentesting and risk assessment of Microsoft Azure environments

See you at the next episode!

Episoder(344)

What is a Connected Car | How to secure api in connected cars? - Virtual Coffee with Ashish - Alissa Knight

What is a Connected Car | How to secure api in connected cars? - Virtual Coffee with Ashish - Alissa Knight

In this episode of the Virtual Coffee with Ashish edition, we spoke with Alissa Knight, Car Hacker, Author, Cybersecurity Influencer and Entrepreneur Host: Ashish Rajan - Twitter @hashishrajan Gues...

24 Mai 20201h 3min

What is SRE? When should i have SRE? - Virtual Coffee with Ashish - Tim Heckman

What is SRE? When should i have SRE? - Virtual Coffee with Ashish - Tim Heckman

In this episode of the Virtual Coffee with Ashish edition, we spoke with Tim Heckman, Sr. SRE Netflix. Host: Ashish Rajan - Twitter @hashishrajan Guest: Tim Heckman What is SRE? Is it helpful t...

17 Mai 202040min

NIST CyberSecurity Metrics for the Board - Taylor Hersom

NIST CyberSecurity Metrics for the Board - Taylor Hersom

In this episode of the Virtual Coffee with Ashish edition, we spoke with @Taylor Hersom about Why do CyberSecurity Professionals need to think about talking Cyber Security to the board? What kind ...

10 Mai 202057min

Virtual Coffee with Ashish - Cloud Security Podcast & Hacker Valley Studio

Virtual Coffee with Ashish - Cloud Security Podcast & Hacker Valley Studio

In this episode, we sit with Chris Cochran & Ronald Eddings from Hacker Valley Studio. Chris Cochran & Ronald Eddings from Hacker Valley Studio & Ashish spoke about How did you get into CyberSecurit...

3 Mai 20201h

Scaling a DevSecOps model | SERVERLESS SECURITY BEST PRACTICES with Abhay Bhargav , CTO , we45

Scaling a DevSecOps model | SERVERLESS SECURITY BEST PRACTICES with Abhay Bhargav , CTO , we45

In this episode, we sit with Abhay Bhargav, CTO, we45. Abhay & Ashish spoke about What is Cloud Security? Is multi-cloud a thing? What is DevSecOps? What is a good maturity in the DevSecOps sp...

26 Apr 202041min

CORONAVIRUS & CYBERSECURITY | ISOLATION LIFE

CORONAVIRUS & CYBERSECURITY | ISOLATION LIFE

In this episode, we are covering a trending topic CORONAVIRUS OR COVID19 and how it is affecting businesses around me and my friends & colleagues. I also talk about my personal challenge with starting...

19 Apr 202010min

How to secure and improve cloud environment - Merritt Baer, Principal Security Architect, AWS

How to secure and improve cloud environment - Merritt Baer, Principal Security Architect, AWS

In this episode, we sit with Merritt Baer, Principal Security Architect, AWS. Merritt & Ashish spoke about What is Cloud Security? What does security look like in a mature organisation? How can...

11 Apr 202052min

Cloud Center of Excellence in AWS | How Atlassian manages Risk and Compliance - Atlassian 2020

Cloud Center of Excellence in AWS | How Atlassian manages Risk and Compliance - Atlassian 2020

In this episode, we sit with Michael Fuller, Cloud Centre of Excellence, Atlassian. Michael & Ashish spoke about Importance of being standardisation of security across the cloud footprint? Challen...

5 Apr 202037min

Populært innen Teknologi

lydartikler-fra-aftenposten
romkapsel
teknisk-sett
tomprat-med-gunnar-tjomlid
rss-impressions-2
shifter
rss-ki-praten
fornybaren
rss-alt-vi-kan
rss-ai-forklart
smart-forklart
nasjonal-sikkerhetsmyndighet-nsm
elektropodden
pedagogisk-intelligens
energi-og-klima
hans-petter-og-co
rss-teknologioptimistene-energibransjens-it-podcast
rss-praktisk-proptech
rss-startup
rss-polypod