AWS Goat - Cloud Penetration Testing

AWS Goat - Cloud Penetration Testing

Cloud Security Podcast - This month we are talking about "Breaking the AWS Cloud" and next up on this series, we spoke to Nishant Sharma (Nishant's Linkedin), Director, Lab Platform, INE. If you have tried pentesting in AWS Cloud or want to start today with AWS Goat, then this episode with Nishant, behind AWS Goat will help you understand how you can upskill and maybe even show others how to be better at pentesting AWS Cloud.

Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv

Host Twitter: Ashish Rajan (@hashishrajan)

Guest Twitter: Nishant Sharma (Nishant's Linkedin)

Podcast Twitter - @CloudSecPod @CloudSecureNews

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- Cloud Security News

- Cloud Security Academy

Spotify TimeStamp for Interview Questions

(00:00) Introduction

(03:51) snyk.io/csp

(04:51) What is Cloud Pentesting?

(06:19) Cloud pentesting vs Web App & Network

(08:37) What is AWS Goat?

(13:12) Do you need permission from AWS to do pentesting?

(14:03) Pentesting an application vs pentesting AWS S3

(15:40) What is AWS Goat testing?

(18:14) Cloud penetration testing tools

(19:59) How useful is a metadata of a cloud instance?

(22:24) AWS Pentesting and OWASP Top 10

(25:31) How to build internal training for Cloud Security?

(29:43) Keep building knowledge on AWS Goat

(30:33) Using CloudShell for AWS pentesting

(34:09) ChatGPT for cloud pentesting

(36:28) Vulnerable serverless application

(39:40) Pentesting Amazon ECS

(43:01) How do you protect against ECS misconfigurations?

(47:38) What is the future plan for AWS Goat?

(50:28) Fun Questions

See you at the next episode!

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(360)

Securing Millions of AI-built Apps: How Lovable Defends Against Insider Threats

Securing Millions of AI-built Apps: How Lovable Defends Against Insider Threats

Empowering non-technical users to build production-grade applications requires a proactive, secure-by-design architecture. In this episode, Ashish sits down with Marcus Hallberg and Samuel Kelemen, se...

11 Sep 1h 10min

Why AI Won't Replace Your SOC: Federated Data & APEX Framework

Why AI Won't Replace Your SOC: Federated Data & APEX Framework

Hash values, IP addresses, and domains are virtually useless as primary detection mechanisms in the era of AI-driven polymorphic malware and short-lived phishing kits. If your detection strategy is st...

1 Sep 37min

The "Hunt First" AI Security Strategy

The "Hunt First" AI Security Strategy

Did you know that 82% of all intrusions don't involve any sort of malware, and AI-augmented attacks are up 89% year over year? If your security operations team is solely focused on reacting to known-b...

25 Aug 46min

Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane?

Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane?

When Claude Cowork hits a roadblock, it doesn't give up, it writes a custom Python script and downloads an untrusted NPM package just to bypass its restrictions and finish its goal. Are your security ...

18 Aug 32min

How Adobe Uses AI Agents for building a WAF Pipeline?

How Adobe Uses AI Agents for building a WAF Pipeline?

When vulnerability disclosures shrink the wild exploit window down to less than 24 hours (or even minutes), traditional manual patching and WAF rule creation simply cannot keep up.In this episode, Ash...

4 Aug 47min

Why Runtime Agents Are Replacing Static Posture Checks

Why Runtime Agents Are Replacing Static Posture Checks

The attack window from the discovery of a vulnerability to its exploitation has shrunk to less than 24 hours and sometimes down to just 25 minutes. Is your security team prepared for the speed of AI-d...

28 Jul 44min

The Hidden Cost of BlackBox AI: Bridging Cloud and Code Security

The Hidden Cost of BlackBox AI: Bridging Cloud and Code Security

Traditional SCA and SAST tools are notorious for drowning security teams in false positives, historically flagging nine out of ten alerts incorrectly. But while generative AI seems like a magic bullet...

9 Jul 42min

Who Governs Your AI Agents? Identity, Offboarding & Open Standards

Who Governs Your AI Agents? Identity, Offboarding & Open Standards

Are overprivileged AI agents the biggest emerging threat in cybersecurity? In a recent high-profile attack, a vibe-coding company had its entire source code stolen because an attacker exploited a long...

2 Jul 34min

Populært innen Teknologi

tomprat-med-gunnar-tjomlid
teknisk-sett
rss-kunstig-intelligens-med-elisabeth-maren-og-morten
energi-og-klima
lydartikler-fra-aftenposten
nasjonal-sikkerhetsmyndighet-nsm
hans-petter-og-co
elektropodden
rss-ki-praten
shifter
rss-alt-som-gar-pa-strom
rss-ai-forklart
smart-forklart
teknologi-og-mennesker
fornybaren
rss-snakk-om-sikkerhet
rss-alt-vi-kan
pedagogisk-intelligens
rss-heis
rss-ki-til-kaffen