The Azure Cloud Security Pentesting Skills You NEED!

The Azure Cloud Security Pentesting Skills You NEED!

Karl Fosaaen, the author of Penetration Testing "Azure for Ethical Hacker" and the VP of Research at NetSPI, came as a guest to share why the penetration Test of a Web Application hosted on Azure Cloud in 2023 is quite different to just a simple/traditional web app pentesting and the skills you need to pentest Azure environments. Cloud Penetration testing is misunderstood to be just config review in Microsoft Azure Cloud just like in AWS and Google Cloud. In this video, we have Karl Fosaaen was kind enough to answer the following questions and methods.


Episode YouTube: ⁠ ⁠⁠⁠Video Link⁠⁠⁠⁠⁠⁠


Host Twitter: Ashish Rajan (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@hashishrajan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠)

Guest Socials: Karl's Linkedin (⁠⁠⁠⁠Karl Fosaaen)

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠


Spotify TimeStamp for Interview Question

(00:00) Introduction

(02:32) A bit about Karl Fosaaen

(03:26) How is pentesting in Azure different from AWS?

(04:35) Cloud pentesting is not just config review

(05:42) Cloud pentesting vs Network pentesting

(06:25) Cloud Pentest - Next evolution of Network Pentest?

(07:14) Boundaries of cloud pentesting

(09:07) Do you need prior approval for Azure Pentest?

(09:32) Working with Microsoft Security Research Centre

(10:35) Process of pentesting in Azure

(11:57) Low hanging fruits to start off with!

(13:37) How to persist and escalate?

(14:58) Managed Identities in Azure

(16:23) Impact of peripheral services to Azure

(18:33) Scale of deployments in Azure

(21:02) Getting access to permissions for Azure Entra

(22:36) Scaling your pentest tools

(23:34) TTPs or Matrix you can use

(25:30) Getting into Azure Pentesting

(26:56) Transitioning from network to azure pentesting

(28:37) Connect with Karl


Resources:

The NetSPI Blog to learn more about offensive cloud security

Mitre - Cloud Attack Matrix

ATRM

Karl's Book - Penetration Testing Azure for Ethical Hackers: Develop practical skills to perform pentesting and risk assessment of Microsoft Azure environments

See you at the next episode!

Avsnitt(344)

RED TEAM IN CLOUD - Brianna Malcolmson, Atlassian

RED TEAM IN CLOUD - Brianna Malcolmson, Atlassian

In this episode of the Virtual Coffee with Ashish edition, we spoke with Brianna Malcolmson, Security Engineering Manager, Atlassian Host: Ashish Rajan - Twitter @hashishrajan Guest: Brianna Malco...

24 Jan 202147min

INFRASTRUCTURE AS CODE SECURITY

INFRASTRUCTURE AS CODE SECURITY

In this episode of the Virtual Coffee with Ashish edition, we spoke with Matt Johnson, Developer Advocate Lead, Bridgecrew. Host: Ashish Rajan - Twitter @hashishrajan Guest: Matt Johnson - Twitter ...

17 Jan 202150min

Cloud Security Testing in AWS

Cloud Security Testing in AWS

In this episode of the Virtual Coffee with Ashish edition, we spoke with Pawel Rzepa, Snr Security Consultant, SecuRing. Host: Ashish Rajan - Twitter @hashishrajan Guest: Pawel Rzepa - Twitter @rze...

10 Jan 202152min

HOW TO BECOME A CLOUD SECURITY ARCHITECT in 2021 ? - Sriya Potham

HOW TO BECOME A CLOUD SECURITY ARCHITECT in 2021 ? - Sriya Potham

In this episode of the Virtual Coffee with Ashish edition, we spoke with Sriya Potham, Principal Cloud Security Architect Host: Ashish Rajan - Twitter @hashishrajan Guest: Sriya Potham - Linkedin @...

3 Jan 202144min

STARTING A SUCCESSFUL CYBERSECURITY PODCAST IN 2021

STARTING A SUCCESSFUL CYBERSECURITY PODCAST IN 2021

In this Christmas special episode of the Virtual Coffee with Ashish edition, we had a panel of successful CyberSecurity Podcast Hosts that answered questions about starting and running a successful Cy...

20 Dec 20201h 3min

RISK MANAGEMENT IN CLOUD SECURITY - MONICA VERMA

RISK MANAGEMENT IN CLOUD SECURITY - MONICA VERMA

In this episode of the Virtual Coffee with Ashish edition, we spoke with Monica Verma, CISO Host: Ashish Rajan - Twitter @hashishrajan Guest: Monica Verma - Linkedin @monicaverma In this episode, ...

29 Nov 202048min

WHAT IS DIGITAL RISK PROTECTION & WHY IS IT IMPORTANT? - Sam Small, Zerofox

WHAT IS DIGITAL RISK PROTECTION & WHY IS IT IMPORTANT? - Sam Small, Zerofox

In this episode of the Virtual Coffee with Ashish edition, we spoke with Sam Small, Chief Security Officer, Zerofox Host: Ashish Rajan - Twitter @hashishrajan Guest: Sam Small - Linkedin @samsmallp...

22 Nov 202054min

OPEN SOURCE AWS SECURITY - MATTHEW FULLER, co-Founder CloudSploit, Aqua

OPEN SOURCE AWS SECURITY - MATTHEW FULLER, co-Founder CloudSploit, Aqua

In this episode of the Virtual Coffee with Ashish edition, we spoke with Matthew Fuller, co-Founder CloudSploit, Aqua Host: Ashish Rajan - Twitter @hashishrajan Guest: Matthew Fuller - Linkedin @ma...

15 Nov 202047min

Populärt inom Teknik

uppgang-och-fall
elbilsveckan
market-makers
rss-technokratin
har-vi-akt-till-mars-an
natets-morka-sida
rss-laddstationen-med-elbilen-i-sverige
skogsforum-podcast
rss-en-ai-till-kaffet
bilar-med-sladd
teknikveckan
hej-bruksbil
rss-veckans-ai
rss-elektrikerpodden
dom-kallar-oss-krypto
ai-sweden-podcast
bli-saker-podden
rss-upplyst-entreprenordirektor
gubbar-som-tjotar-om-bilar
rss-powerboat-sverige-podcast