SANS Cloud Security
SANS Cloud Security
  • 404
  • 378 860
HANDS-ON WORKSHOP | Cloud Security for Leaders: Aviata Chapter 8
Join Principal Instructor, Jason Lam and learn actionable insights and strategies to help you effectively manage and secure your cloud environments.
ACCESS THE DIGITAL WORKBOOK, SLIDES, AND ORIGINAL RECORDING: www.sans.org/webcasts/aviata-solo-flight-challenge-cloud-security-workshop-chapter-8/
Migrating to and operating in the cloud is a complex process, requiring numerous critical decisions. It’s akin to the role of an air traffic controller in aviation-where decisions and instructions must be directed to the right teams within the organization to ensure a successful cloud migration and smooth operations. This hands-on practical simulation places you in the controller’s seat, allowing you to analyze situations and make the right calls for cloud security actions.
Learning Objectives:
- Understand key decisions during cloud adoption
- Assess real world cloud scenarios and make the optimal decision
- Enhance security capabilities for your cloud environment
About the Speaker:
Jason holds a leadership role at a large global financial company. In this role, he’s accountable for global direction and management of cyber security defense and response. He has nearly two decades of experience in the information security industry, progressing from hands-on research work to securing large-scale enterprise environments. Over the years, Jason has performed and led intrusion detection, penetration testing, defense improvement programs and incident response in large enterprise environments. Jason is a co-author and instructor for SEC522: Application Security: Securing Web Apps, APIs, and Microservices as well as sole author of LDR520: Cloud Security for Leaders. Learn more about Jason, www.sans.org/profiles/jason-lam/
This workshop supports content from LDR520: Cloud Security for Leaders. Learn more about the course at www.sans.org/ldr520/
SANS Cloud Security focuses the deep resources of SANS on the growing threats to The Cloud by providing training, GIAC certification, research, and community initiatives to help security professionals build, deploy and manage secure cloud infrastructure, platforms, and applications.
SANS Cloud Security Curriculum: www.sans.org/cloud-security
GIAC Cloud Security Certifications: www.giac.org/focus-areas/cloud-security/
LinkedIn: www.linkedin.com/showcase/sanscloudsec/
Discord: www.sansurl.com/cloud-discord
Twitter: @SANSCloudSec
มุมมอง: 160

วีดีโอ

Spooky Scary Lambda Attacks | Cloud Security Webcast
มุมมอง 223หลายเดือนก่อน
In AWS, the Lambda function represents a new approach to crafting and deploying compute workflows. While they free us from the burdens of patching VMs, lurking in the dark are countless ways deployment and operations can go horribly wrong. This talk will dive deep into the sinister ways attackers can exploit Lambda functions, turning them into gateways for intrusion and chaos. We will expose co...
HANDS-ON WORKSHOP | API Security Flight School: Aviata Chapter 7
มุมมอง 208หลายเดือนก่อน
Join Dr. Johannes Ullrich and principle instructor Jason Lam, and learn essential techniques for defending your APIs against real-world threats that you can start using immediately! In this chapter, you'll learn about the vulnerabilities of APIs in modern distributed applications and gain hands-on experience with defending against common API attacks. ACCESS THE DIGITAL WORKBOOK, SLIDES, AND ORI...
Critical CSPM Vulnerability Spotted: What You Need to Know
มุมมอง 237หลายเดือนก่อน
Cloud vendors require extensive access to your organization's cloud environments. This includes security vendors. For example, if a security team wants to use a Cloud Security Posture Management (CSPM) tool to scan their cloud environments, the CSPM needs read access to nearly every service. They are entrusting the CSPM with their cloud data, so the CSPM needs to take great care that this acces...
SANS CloudSecNext Summit 2024 Keynote Panel
มุมมอง 4832 หลายเดือนก่อน
SANS CloudSecNext Summit 2024 Keynote Panel Panelists: Frank Kim, Fellow, SANS Institute Eric Johnson, Senior Instructor, SANS Institute Kevin Tyers, Certified Instructor, SANS Institute Casey Essary, Deputy CISO, BILL View upcoming Summits: www.sans.org/u/DuS SANS Cloud Security Curriculum: www.sans.org/cloud-security GIAC Cloud Security Certifications: www.giac.org/focus-areas/cloud-security/...
Keep Calm and How to Deploy Safely at Billion Event Scale
มุมมอง 1092 หลายเดือนก่อน
In today's high-scale and high-velocity complex operations, the process and culture are as important as the technology that supports it. In this talk, end-user unicorn AppsFlyer will talk about their journey to building a platform-as-a-product to achieve the velocity, predictability, and self-serve using GitOps to the massive scale their system today requires. We'll look at considerations like ...
Open Source Serverless Cloud Certificate Authority
มุมมอง 1972 หลายเดือนก่อน
In this talk, we’ll provide details of our recently released open-source project. After a technical overview, you’ll see a hands-on live demonstration of the CA and an example mTLS use case. You’ll learn how you could use this solution for your own applications and systems, to provide a secure and cost-effective certificate authority infrastructure. SANS CloudSecNext Summit 2024 Open-source ser...
Threat Hunting with Kusto The Query Language to Uncovering the Unknown
มุมมอง 2942 หลายเดือนก่อน
Join us for an illuminating session on leveraging Kusto, Microsoft's powerful query language, for effective threat hunting. Kusto, offers unparalleled capabilities for analyzing large volumes of data with lightning speed and precision. In this session, we'll dive into the fundamentals of Kusto and explore how it can be used to detect and investigate security threats within your organization's d...
EKS Security Safari Hunting Threats in the Wild Wild Cloud
มุมมอง 1672 หลายเดือนก่อน
Kubernetes is spreading through the world faster than a viral dance challenge on social media. As the K8S ecosystem on the cloud gains more attention and spotlight, hackers actively seek ways to bounce between clusters and clouds, aiming for unauthorized access. Join us to delve deep into the K8S security fundamentals on AWS (EKS) and their logging system. Explore K8S TTPs, K8S to AWS attack ve...
Who Polices the Policies Privilege Escalation and Persistence with Azure Policy
มุมมอง 1122 หลายเดือนก่อน
The Microsoft Azure threat matrix contains a mysterious and almost empty item: AZT508 - Azure Policy, which suggests this service can break bad but gives almost no details as to how. To quote Microsoft: “Azure Policy helps to enforce organizational standards and to assess compliance at-scale.“ How does this banal sounding service come to be used for attacking Azure users? This talk aims to fill...
Cloudy with a Chance of Meatballs Handling the Unexpected in Cloud Threat Detection
มุมมอง 1202 หลายเดือนก่อน
Threat Detection is hard- it requires deep knowledge about the platform you're detecting on, knowledge of how that platform is attacked, and the technical savvy to interpret logs and write code that detects on those attacks. So what do we do in the case of cloud platforms, where the platform and the logs are constantly changing? This presentation will cover lessons learned in cloud threat detec...
From AFT to ATO, AWS native FedRAMP through Terraform
มุมมอง 882 หลายเดือนก่อน
The process of obtaining a FedRAMP ATO in the AWS cloud, often begins with a separation of federal and commercial resources. This separation, or sometimes a move to a new AWS account, is a long and tedious process when starting from zero. We can simplify and automate this process using Terraform with AWS Control Tower via AFT. In this talk we'll look at how Terraform, AFT, and Control tower can...
Identity Crisis Tracking Adversaries in AWS
มุมมอง 1322 หลายเดือนก่อน
Managing identities in the cloud can be a challenging task, even for seasoned cloud professionals. To be effective, cloud security practitioners must grasp how adversaries exploit this complexity to confuse defenders and evade detection. Traditional methods of tracking attackers through a single IP address are no longer sufficient-in today's cloud landscape, we must learn to trace their activit...
Provable Security Building Automated Validation of Your Cloud Security Controls
มุมมอง 1392 หลายเดือนก่อน
How well are your security controls working in your cloud environment? Would you know if they had gaps an attacker could exploit? Could you prove it? Cloud service providers ship new features at breakneck speed. Currently, AWS has over 15,000 APIs and 16,000 permissions. At this scale, it can be difficult to define proper security controls for your organization, verify they’re working as intend...
Thinking Inside the Box Effective DevSecOps for Containers
มุมมอง 1312 หลายเดือนก่อน
Containers can be a powerful DevOps tool to greatly improve the consistency and scalability of your environment. But how do we establish visibility and security in our containers without excessive overhead? We’ll start with an overview of the security challenges posed by containers, and how those can be magnified if we aren’t doing DevOps right. Next, we’ll go over DevSecOps best practices for ...
The Yin and Yang of Generative AI in Cybersecurity Opportunities and Challenges
มุมมอง 1402 หลายเดือนก่อน
The Yin and Yang of Generative AI in Cybersecurity Opportunities and Challenges
A Needle in a Haystack How to Find a Threat Hidden in Over 6 Billion Logs Per Day
มุมมอง 1242 หลายเดือนก่อน
A Needle in a Haystack How to Find a Threat Hidden in Over 6 Billion Logs Per Day
Keynote | Security Journey at Elastic
มุมมอง 792 หลายเดือนก่อน
Keynote | Security Journey at Elastic
Adding functionality to the AzureRM Provider for SecOps
มุมมอง 602 หลายเดือนก่อน
Adding functionality to the AzureRM Provider for SecOps
Unpacking the Psycho Cyber IAM Kill Chain
มุมมอง 1172 หลายเดือนก่อน
Unpacking the Psycho Cyber IAM Kill Chain
When Cloud Encryption Matters From Another Layer of Access Control to a False Sense of Security
มุมมอง 1112 หลายเดือนก่อน
When Cloud Encryption Matters From Another Layer of Access Control to a False Sense of Security
Exploring Identity Integrations between the Three CSPs and their Managed Kubernetes Offerings
มุมมอง 742 หลายเดือนก่อน
Exploring Identity Integrations between the Three CSPs and their Managed Kubernetes Offerings
Best Practices for How to Manage All Your Access from the Cloud
มุมมอง 5792 หลายเดือนก่อน
Best Practices for How to Manage All Your Access from the Cloud
HANDS-ON WORKSHOP | Making the Switch to Azure Monitor Agent: Aviata Chapter 6
มุมมอง 2292 หลายเดือนก่อน
HANDS-ON WORKSHOP | Making the Switch to Azure Monitor Agent: Aviata Chapter 6
GENAI Security: Risks and Challenges
มุมมอง 3612 หลายเดือนก่อน
GENAI Security: Risks and Challenges
HANDS-ON WORKSHOP | Centralizing Cross-Cloud Security Events: Aviata Chapter 5
มุมมอง 1832 หลายเดือนก่อน
HANDS-ON WORKSHOP | Centralizing Cross-Cloud Security Events: Aviata Chapter 5
HANDS-ON WORKSHOP | Attack and Detect Kubernetes: Aviata Chapter 4
มุมมอง 3103 หลายเดือนก่อน
HANDS-ON WORKSHOP | Attack and Detect Kubernetes: Aviata Chapter 4
HANDS-ON WORKSHOP | Transitioning to Containerization: Aviata Chapter 3
มุมมอง 3115 หลายเดือนก่อน
HANDS-ON WORKSHOP | Transitioning to Containerization: Aviata Chapter 3
Defending Against Path Traversal Attacks
มุมมอง 2846 หลายเดือนก่อน
Defending Against Path Traversal Attacks
Evolution of SIEM in the Cloud
มุมมอง 4086 หลายเดือนก่อน
Evolution of SIEM in the Cloud

ความคิดเห็น

  • @johndeleon6101
    @johndeleon6101 24 วันที่ผ่านมา

    Very, very nice!

  • @GOTHAM21
    @GOTHAM21 25 วันที่ผ่านมา

    Somebody buy her a mic.

  • @Zombiedmonkey
    @Zombiedmonkey หลายเดือนก่อน

    🎉

  • @Z3kyTw0
    @Z3kyTw0 2 หลายเดือนก่อน

    Thanks for uploading this free workshop!

  • @ranjansoumyab1963
    @ranjansoumyab1963 2 หลายเดือนก่อน

    Other than in the Infosec webinars, podcasts or seminars;; no where I find security is a factor for consideration. Just look into any job forums or opportunity, you'll find 100 opportunities for a outdated tools admin but security is still a afterthought.

  • @SimZoneStudios
    @SimZoneStudios 2 หลายเดือนก่อน

    That was the most lame answer ever why you would choose sentinel. You basically just said you should only use sentinel if you are all in on the Microsoft stack and then moved on to the rest of the presentation. Sentinel is awesome even if you are not using any other Microsoft service. Down voting.

  • @MrFools123
    @MrFools123 4 หลายเดือนก่อน

    can't really see. the resolution is so bad.

  • @DrNeedles54
    @DrNeedles54 5 หลายเดือนก่อน

    I use a tool that helps with so many points you mentioned - ArmorCode - normalizes across scanners and internal data sources like CMDB + Reprioritizes based on context of internal systems + Automates manual remediation tasks + Tailored reports to various stakeholders. Check it out!

  • @noname-vl6vy
    @noname-vl6vy 5 หลายเดือนก่อน

    this is a big help but can you have a session where you filter the logs from the aws side before sending it to sentinel? is it even possible? how?

  • @TheAckdog
    @TheAckdog 5 หลายเดือนก่อน

    Appreciate the workshop. Much appreciated!

  • @jimdiroffii
    @jimdiroffii 6 หลายเดือนก่อน

    Thanks for the free resources! Great talk and walkthrough.

  • @TheGoodStink1
    @TheGoodStink1 7 หลายเดือนก่อน

    Great content, thanks Jon!

  • @AthAthanasius
    @AthAthanasius 7 หลายเดือนก่อน

    03:00 - The moment I read/heard about this video my immediate thought was "Er, just use prepared statements?", and wondered if there was going to be more than that to this video. I'll watch the rest now :) . Although I do note that in *PERL*, the last time I did that years ago, it was a bit of a pain if you had a use case where you wanted the *same* variable to be bound in more than one place in the statement. You couldn't do that and the workaround I found was to just copy the value into a temporary variable and reference *that* in the 2nd use (and so on with second temporary for a 3rd use etc).

    • @johannesullrich3297
      @johannesullrich3297 6 หลายเดือนก่อน

      Good old Perl ;) Perl DBI used to "simular" prepared statements for MySQL pre 4.0.

  • @manavkumar1071
    @manavkumar1071 7 หลายเดือนก่อน

    Great

  • @dmaloney1095
    @dmaloney1095 7 หลายเดือนก่อน

    Studying for GCFR now

  • @ram_bam
    @ram_bam 8 หลายเดือนก่อน

    Great stuff, Brandon!

  • @torinbainter5752
    @torinbainter5752 8 หลายเดือนก่อน

    Thanks Serge, I'm enjoying the content!

  • @MrKaiat
    @MrKaiat 8 หลายเดือนก่อน

    ah, declare -f ! That solves a mystery. Thanks Brandon!

  • @lesliefreeman1293
    @lesliefreeman1293 9 หลายเดือนก่อน

    ✌️ 'Promo SM'

  • @kevinfernandes4097
    @kevinfernandes4097 9 หลายเดือนก่อน

    Where can i find the repo with the files?

  • @kevinfernandes4097
    @kevinfernandes4097 9 หลายเดือนก่อน

    Where can i find the manifests ?

  • @LEARN1518
    @LEARN1518 10 หลายเดือนก่อน

    Thank You Brandon

  • @a.w.5097
    @a.w.5097 10 หลายเดือนก่อน

    Sounds like he's in tunnel of water.

  • @SomeInfoSecDude
    @SomeInfoSecDude 10 หลายเดือนก่อน

    Clearly explained and did not put me to sleep. Quite a feat for a very dry subject.

  • @B4EB4E
    @B4EB4E 10 หลายเดือนก่อน

    please do you teach powershell? i really enjoyed your teaching you are a great teacher, you should do more teachings smiles

  • @bubblyboy78
    @bubblyboy78 11 หลายเดือนก่อน

    So why doesn't Terraform apply catch the manually created Security Group before and after the --refresh-only?

  • @ram_bam
    @ram_bam ปีที่แล้ว

    Excellent presentation.

  • @Douglas_Gillette
    @Douglas_Gillette ปีที่แล้ว

    This conversation was great. Thank you.

  • @anthonynash8774
    @anthonynash8774 ปีที่แล้ว

    This was awesome!! You mentioned providing access to your slides; however, I don't see any links for accessing them... --A

  • @nightshade37
    @nightshade37 ปีที่แล้ว

    Thank you, this was well presented and easy to follow.

  • @BUY_YT_VIEWS_
    @BUY_YT_VIEWS_ ปีที่แล้ว

    when are you gonna post again?

  • @onlyfaas
    @onlyfaas ปีที่แล้ว

    I took SEC588 with some engineers and architects from Sketchers. A very impressive group that knows their stuff! Thanks for the interview.

  • @ram_bam
    @ram_bam ปีที่แล้ว

    Are there any prerequisites for this course? I have a background in web development and am interested.

    • @mwebsec
      @mwebsec 5 หลายเดือนก่อน

      Understanding of OWASP Top 10 vulnerabilities

  • @IceDruid23
    @IceDruid23 ปีที่แล้ว

    Thank you for this presentation. Really good quality.

  • @imwhtim
    @imwhtim ปีที่แล้ว

    this is awesome, really need some more videos on Azure sentinel.

  • @thefrub
    @thefrub ปีที่แล้ว

    Thank you for uploading this! This is exactly the kind of work I hope to be doing once I graduate

  • @killandy01
    @killandy01 ปีที่แล้ว

    W mans

  • @CyberFiducia
    @CyberFiducia ปีที่แล้ว

    Maybe setting up a script on the server that will digest the tail of the log every minute or so. Then report it to the SEIM. If there are indicators then store the verbose log and kick off an alert.

  • @Mature990
    @Mature990 ปีที่แล้ว

    Remarkable presentation.

  • @PandoraApocalypse
    @PandoraApocalypse ปีที่แล้ว

    Excellent one Shaun.This just keeps getting interesting 😎

  • @chidimoses5184
    @chidimoses5184 ปีที่แล้ว

    blurred images. could not see any of the demo clearly.

  • @etutorshop
    @etutorshop ปีที่แล้ว

    The only step missing the documentation is to enable Security Hub before we can go to the summary page.

  • @security365
    @security365 ปีที่แล้ว

    Great presentation !

  • @KenSherman
    @KenSherman ปีที่แล้ว

    I find this section (⚠2:45-3:50) VERY important.😐

  • @KenSherman
    @KenSherman ปีที่แล้ว

    11:35-12:05 I'm glad you interpreted what recommendations or guidances are because people generally tend to not understand that. It's not law. It's a tested best practice or method to ASSIST you towards your goals successfully or with excellence.

  • @TheMightyWalk
    @TheMightyWalk ปีที่แล้ว

    thanks keep going we are listening

  • @kns6132
    @kns6132 ปีที่แล้ว

    good session and very helpful.

  • @Cyber-Marc
    @Cyber-Marc ปีที่แล้ว

    Interesting perspective. The notes suggest the course eventually teaches the use of terraform to secure cloud environments. Why was terraform chosen over using the native IAC services for each provider?

  • @tanker7757
    @tanker7757 ปีที่แล้ว

    That audio was killing me thanks to that person that stepped in and told him there was a problem

  • @anirbandas6257
    @anirbandas6257 ปีที่แล้ว

    That's something fresh. Amazing!