The Azure Cloud Security Pentesting Skills You NEED!

The Azure Cloud Security Pentesting Skills You NEED!

Karl Fosaaen, the author of Penetration Testing "Azure for Ethical Hacker" and the VP of Research at NetSPI, came as a guest to share why the penetration Test of a Web Application hosted on Azure Cloud in 2023 is quite different to just a simple/traditional web app pentesting and the skills you need to pentest Azure environments. Cloud Penetration testing is misunderstood to be just config review in Microsoft Azure Cloud just like in AWS and Google Cloud. In this video, we have Karl Fosaaen was kind enough to answer the following questions and methods.


Episode YouTube: ⁠ ⁠⁠⁠Video Link⁠⁠⁠⁠⁠⁠


Host Twitter: Ashish Rajan (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@hashishrajan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠)

Guest Socials: Karl's Linkedin (⁠⁠⁠⁠Karl Fosaaen)

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠


Spotify TimeStamp for Interview Question

(00:00) Introduction

(02:32) A bit about Karl Fosaaen

(03:26) How is pentesting in Azure different from AWS?

(04:35) Cloud pentesting is not just config review

(05:42) Cloud pentesting vs Network pentesting

(06:25) Cloud Pentest - Next evolution of Network Pentest?

(07:14) Boundaries of cloud pentesting

(09:07) Do you need prior approval for Azure Pentest?

(09:32) Working with Microsoft Security Research Centre

(10:35) Process of pentesting in Azure

(11:57) Low hanging fruits to start off with!

(13:37) How to persist and escalate?

(14:58) Managed Identities in Azure

(16:23) Impact of peripheral services to Azure

(18:33) Scale of deployments in Azure

(21:02) Getting access to permissions for Azure Entra

(22:36) Scaling your pentest tools

(23:34) TTPs or Matrix you can use

(25:30) Getting into Azure Pentesting

(26:56) Transitioning from network to azure pentesting

(28:37) Connect with Karl


Resources:

The NetSPI Blog to learn more about offensive cloud security

Mitre - Cloud Attack Matrix

ATRM

Karl's Book - Penetration Testing Azure for Ethical Hackers: Develop practical skills to perform pentesting and risk assessment of Microsoft Azure environments

See you at the next episode!

Avsnitt(344)

Solving Prompt Injection & Shadow AI for AI Malware

Solving Prompt Injection & Shadow AI for AI Malware

Are AI agents functioning like adversarial malware inside your network? In this episode of the Cloud Security Podcast, Ashish sits down with Jasson Casey, Co-founder and CEO of Beyond Identity, to spe...

7 Apr 36min

Browser Security Explained: Consent Phishing, "Click Fix" Attacks & The Limits of EDR

Browser Security Explained: Consent Phishing, "Click Fix" Attacks & The Limits of EDR

Is your security team treating your Identity Provider (IDP) like a firewall? In this episode, Adam Bateman (CEO & Co-founder of Push Security) explains why that's a dangerous mistake and how modern at...

10 Mars 46min

Is AI Hallucinations a Myth and the Real Threat from AI

Is AI Hallucinations a Myth and the Real Threat from AI

Are attackers really using AI to run end-to-end cyber campaigns? In this episode, Edward Wu (Founder and CEO, DropzoneAI) joins Ashish to separate the hype from reality when it comes to AI-driven atta...

6 Mars 40min

Why AI Infrastructure is Harder to Secure Than Cloud

Why AI Infrastructure is Harder to Secure Than Cloud

Is AI security just "Cloud Security 2.0"? Toni De La Fuente, creator of the open-source tool Prowler, joins Ashish to explain why securing AI workloads requires a fundamentally different approach than...

20 Feb 34min

How Attackers Bypass AI Guardrails with Natural Language

How Attackers Bypass AI Guardrails with Natural Language

In the world of Generative AI, natural language has become the new executable. Attackers no longer need complex code to breach your systems, sometimes, asking for a "poem" is enough to steal your pass...

10 Feb 46min

Vulnerability Management vs. Exposure Management

Vulnerability Management vs. Exposure Management

In this episode, Brad Hibbert (COO & Chief Strategy Officer at Brinqa) joins Ashish to explain why traditional risk-based vulnerability management (RBVM) is no longer enough in a cloud-first world .We...

6 Feb 39min

Is Developer Friendly AI Security Possible with MCP & Shadow AI

Is Developer Friendly AI Security Possible with MCP & Shadow AI

Is "developer-friendly" AI security actually possible? In this episode, Bryan Woolgar-O'Neil (CTO & Co-founder of Harmonic Security) joins Ashish to dismantle the traditional "block everything" approa...

5 Feb 1h 3min

Why AI Can't Replace Detection Engineers: Build vs. Buy & The Future of SOC

Why AI Can't Replace Detection Engineers: Build vs. Buy & The Future of SOC

Is the AI SOC a reality, or just vendor hype? In this episode, Antoinette Stevens (Principal Security Engineer at Ramp) joins Ashish to dissect the true state of AI in detection engineering.Antoinette...

21 Jan 52min

Populärt inom Teknik

uppgang-och-fall
elbilsveckan
market-makers
rss-technokratin
har-vi-akt-till-mars-an
natets-morka-sida
rss-laddstationen-med-elbilen-i-sverige
skogsforum-podcast
rss-en-ai-till-kaffet
bilar-med-sladd
teknikveckan
hej-bruksbil
rss-veckans-ai
rss-elektrikerpodden
dom-kallar-oss-krypto
ai-sweden-podcast
bli-saker-podden
rss-upplyst-entreprenordirektor
gubbar-som-tjotar-om-bilar
rss-powerboat-sverige-podcast