Learn Cloud Security
Hands-on tutorials, configuration walkthroughs, and deep dives into securing AWS, GCP, Azure, DigitalOcean, and Kubernetes.
A guide to protect against the 8KB WAF limitation in Google Cloud Armor
Google Cloud Armor has a documented limitation related to the maximum size of an HTTP POST request body the service is able to inspect and block. Attackers can use this limitation to bypass the protection provided by Cloud Armor and potentially exploit vulnerabilities that may be present in an underlying web application. This article will take you through how Cloud Armor rules can be configured to appropriately mitigate the risk due to the limitation.
How to disable Internet wide access to the S3 bucket in AWS
We will go through the steps to to enable Block public access for S3 bucket in AWS
How to disable Internet wide access to the S3 bucket using AWS CLI
We will go through the steps to to enable Block public access for S3 bucket in AWS
How to disable the Database flag remote access for Cloud SQL on the SQL Server instance in Google Cloud via CLI
We will go through the steps to disable the Database flag remote access for Cloud SQL.
How to disable the Database flag remote access for Cloud SQL on the SQL Server instance in Google Cloud
We will go through the steps to disable the Database flag remote access for Cloud SQL.
How to manage cross account Google Cloud projects using service accounts
A quick post to show how service accounts can be setup to allow cross account or intra account Google Cloud project management. This post can be used to set up a service account that can be used to manage resources in other Google Cloud projects.
How to set a Non-limiting Value for the Database flag user connections for Cloud SQL on the SQL Server instance in Google Cloud via CLI
We will go through the steps to set a Non-limiting Value for the Database flag user connections for Cloud SQL on the SQL Server instance.
How to set a Non-limiting Value for the Database flag user connections for Cloud SQL on the SQL Server instance in Google Cloud
We will go through the steps to set a Non-limiting Value for the Database flag user connections for Cloud SQL on the SQL Server instance.
How to disable the Database flag cross db ownership chaining for Cloud SQL on the SQL Server instance via gcloud
We will go through the steps to disable the Database flag cross db ownership chaining for SQL.
How to disable the Database flag cross db ownership chaining for Cloud SQL on the SQL Server instance in Google Cloud
We will go through the steps to disable the Database flag cross db ownership chaining for Cloud SQL.
How to delete an IAM Role using AWS CLI
IAM Roles should be removed if they are no longer being used as a security best practice. This article provides a walkthrough of how to delete an IAM Role using AWS CLI.
How to disable the Database flag user options for Cloud SQL on the SQL Server instance in Google Cloud
We will go through the steps to disable the Database flag user options for Cloud SQL.
How to disable the Database flag user options for Cloud SQL on the SQL Server instance via gcloud
We will go through the steps to disable the Database flag user options for SQL.
How to delete an IAM Role in AWS
IAM Roles should be removed if they are no longer being used as a security best practice. This article provides a walkthrough of how to delete an IAM Role in AWS.
How to remove an IAM User in AWS
Having unused IAM users extends the attack surface. As a security best practice, users should be removed if they are no longer being used. This article provides a walkthrough of how to remove an IAM User in AWS.
How to remove an IAM User using AWS CLI
Having unused IAM users extends the attack surface. As a security best practice, users should be removed if they are no longer being used. This article provides a walkthrough of how to remove an IAM User using AWS CLI.
How to create an IAM Admin user in AWS
It is recommended to have a separate Admin user for managing AWS account, while the root user should be used only for super administrative tasks like managing billing etc. This article provides a step by step guide on how to create an IAM Admin user in AWS.
How to create an IAM Admin user using AWS CLI
It is recommended to have a separate Admin user for managing AWS account, while the root user should be used only for super administrative tasks like managing billing etc. This article provides a step by step guide on how to create an IAM Admin user using AWS CLI.
How to remove the Access key of a user in AWS
IAM user Access keys that are not being used should be removed. This article provides a step by step walkthrough of how to remove the Access key of an IAM user in AWS.
How to remove the Access key of a user using AWS CLI
IAM user Access keys that are not being used should be removed. This article provides a step by step walkthrough of how to remove the Access key of an IAM user using AWS CLI.
How to rotate the Access key of a user in AWS
Access keys are long-term credentials for an AWS user. One of the best ways to protect your account is to ensure access keys are rotated periodically. This article provides a walkthrough of how to rotate Access keys for an IAM user in AWS.
How to rotate the Access key of a user using AWS CLI
Access keys are long-term credentials for an AWS user. One of the best ways to protect your account is to ensure access keys are rotated periodically. This article provides a walkthrough of how to rotate Access keys for an IAM user using AWS CLI.
How to deactivate the Access key of a user in AWS
Access keys for IAM users should be created only if there is a requirement and disabled or deleted afterwards if there won't be any further usage. In this article we take a look at how to deactivate Access keys for an IAM user in AWS.
How to deactivate the Access key of a user using AWS CLI
Access keys for IAM users should be created only if there is a requirement and disabled or deleted afterwards if there won't be any further usage. In this article we take a look at how to deactivate Access keys for an IAM user using AWS CLI.
How to change the password of an IAM User in AWS
Changing passwords periodically is considered to be a security best practice. This article provides a walkthrough of how you can change password for an IAM user in AWS.
How to change the password of an IAM User using AWS CLI
Changing passwords periodically is considered to be a security best practice. This article provides a step by step guide to change password for an IAM user using AWS CLI.
How to enable MFA Delete on S3 bucket
We will go through the steps to enable MFA so that bucket deletion requires an additional layer of security in the form of multi factor authentication.
How to enforce SSL/TLS for S3 requests using AWS
We will go through the steps to enforce SSL/TLS so that bucket policy prevents the contents of the bucket from being served over plaintext HTTP.
How to enforce SSL/TLS for S3 requests using AWS CLI
We will go through the steps to enforce SSL/TLS so that bucket policy prevents the contents of the bucket from being served over plaintext HTTP.
How to Force Delete Kubernetes Namespaces
Quick post that shows with examples, how to delete a Kubernetes namespace that is forever stuck on 'Terminating' stage.
How to conduct assessment with aws-foundations-cis-baseline tool
This post covers the scan report assessment and interpret the results.
How to set up aws-foundations-cis-baseline tool for conducting CIS assessment
This post covers an introduction and instructions to set up the aws-foundations-cis-baseline tool for learning.
How to enable DNSSEC Signing in AWS Route53
Enabling DNSSEC signing increases trust between the user and the target AWS account ensuring that the integrity of the DNS record has not been tampered with and users are receiving information from the correct source. This article provides a step by step guide to enable DNSSEC signing in AWS Route53.
How to enable DNSSEC Signing in Route53 using AWS CLI
Enabling DNSSEC signing increases trust between the user and the target AWS account ensuring that the integrity of the DNS record has not been tampered with and users are receiving information from the correct source. This article provides a step by step guide to enable DNSSEC signing in Route53 using AWS CLI.
How to set up GCP CIS 1.2.0 Benchmark Inspec Profile tool for conducting CIS assessment
This post covers an introduction and instructions to set up the Inspec tool for learning.
Log4j (CVE-2021-44228): Detection, Exploitation and Mitigation
Last week a vulnerability affecting the most common logging packages in Java, Log4j, was made public, complete with exploit code. The vulnerability is rated with a critical severity rating of 10. Successful exploitation allows for a very uncomplicated remote command execution without requiring any authentication over the Internet resulting in a complete compromise of data and system confidentiality, integrity and availability. This blogpost explains the detection methods, exploitation techniques and mitigation instructions of the vulnerability.
How to enable logging for elastic load balancer using AWS CLI
Logging requests to ELB endpoints is a helpful way of detecting and investigating potential attacks, malicious activity, or misuse of backend resources. Logs can be sent to S3 and processed for further analysis.
How to update AWS ELB HTTP Desync mitigation mode using AWS CLI
An AWS ELB with HTTP Desync mitigation mode set to **monitor** could allow a class of HTTP desynchronization attacks against the web server behind the Load Balancer. This article provides a step by step guide on how you can check and update the HTTP Desync mitigation mode for your ELB to a more secure option using AWS CLI.
How to update AWS ELB HTTP Desync mitigation mode
An AWS ELB with HTTP Desync mitigation mode set to **monitor** could allow a class of HTTP desynchronization attacks against the web server behind the Load Balancer. This article provides a step by step guide on how you can check and update the HTTP Desync mitigation mode for your ELB to a more secure option.
How to enable MFA for an IAM User using AWS CLI
AWS IAM provides multi factor authentication capabilities to its users which provides an additional layer of security. This article provides a step by step guide on how to enable multi factor authentication for users using AWS CLI.
5 important security settings you need to review for your GKE clusters
There are some very important settings related to security that you should regularly review in your Google Kubernetes Engine based K8S clusters
Cross Account IAM enumeration via Lambda Resource Policies in AWS Cloud
The article describes a side channel technique to use verbose messages returned by the AWS API to enumerate users and roles in a different AWS account. Article contains proof of concept python script as well.
How to enable logging for elastic load balancer
Logging requests to ELB endpoints is a helpful way of detecting and investigating potential attacks, malicious activity, or misuse of backend resources. Logs can be sent to S3 and processed for further analysis.
How to enable MFA for an IAM User in AWS
AWS IAM provides multi factor authentication capabilities to its users which provides an additional layer of security. This article provides a step by step guide on how to enable multi factor authentication for users in AWS.
How to enforce 2FA for all Cloudflare account members
Cloudflare allows to enforce 2FA for all members in the account. 2FA provides an additional layer of security. This article provides a step by step walkthrough of how you can enforce 2FA for all members on your Cloudflare account.
How to setup AWS CLI on Linux
This academy article provides hands-on guidance on how to setup AWS CLI on Linux. Follow the steps in this article to set up AWS CLI
How to enable public access block to restrict access in S3 using AWS CLI
This article shows how to enable Block public access setting for S3 buckets
How to enable public access block to restrict access in S3
This article shows how to enable Block public access setting for S3 buckets
How to update IAM password policy to require minimum password length of 14 or greater using AWS CLI
IAM password policies can be used to enforce minimum password length to ensure password complexity. This article provides the step by step guide on how you can update your IAM password policy using AWS CLI.
How to enable Uniform Bucket-level Access for Bucket in Google Cloud using CLI
Enabling uniform bucket level access enforces stricter permissions on buckets and objects within. In the absence of uniform level access, bucket policies have to be carefully written to ensure object level access is not obtained.
How to enable Uniform Bucket-level Access for Bucket in Google Cloud
Enabling uniform bucket level access enforces stricter permissions on buckets and objects within. In the absence of uniform level access, bucket policies have to be carefully written to ensure object level access is not obtained.
How to update IAM password policy to require minimum password length of 14 or greater
IAM password policies can be used to enforce minimum password length to ensure password complexity. This article provides the step by step guide on how you can update your IAM password policy in AWS.
Hands-on with Kubernetes Goat - Introduction and Setup
Kubernetes Goat is an intentionally vulnerable Kubernetes cluster environment. This post covers an introduction and instructions to set up the tool for learning.
Auditing Kubernetes with Kubeaudit - Conducting an Assessment
Kuberaudit is a command line tool used to audit Kubernetes clusters for common security issues. This post covers steps to conduct an assessment and interpret the results.
Auditing Kubernetes with Kubeaudit - Introduction and setup
Kuberaudit is a command line tool used to audit Kubernetes clusters for common security issues. This post covers an introduction and instructions to set up the tool to get started.
How to enable 2FA on Cloudflare
Cloudflare provides the ability for users to enable 2FA for their account, which provides an additional layer of security. This article provides a step by step walkthrough of how you can enable 2FA for your Cloudflare account.
Using Prowler for AWS assessment against CIS Foundations benchmark - Part 2 Conducting assessment
Prowler is an Open Source security tool used for AWS security best practices assessments, incident response, audits, continuous monitoring, hardening, and forensics readiness.
Enforce Organization wide 2FA in GitHub
GitHub allows enforcement of organization-wide 2FA authentication which ensures all new users joining your GitHub Organization have 2FA enabled on their accounts. This article provides a quick walkthrough of how to enable this setting in your GitHub Organization.
How to add a new hostname or IP address to a Standalone Kubernetes API server
A short post on adding a new hostname or IP address to the PKI certificate of a Kubernetes cluster so that TLS connections between client (kubectl) and the API server do not generate warnings.
Using Prowler for AWS assessment against CIS Foundations benchmark - Part 1 Introduction and setup
Prowler is an Open Source security tool used for AWS security best practices assessments, incident response, audits, continuous monitoring, hardening, and forensics readiness. This post covers an introduction and instructions to set up the tool for learning.
How to update Base permissions setting in GitHub
This article provides a quick walkthrough of how to update Base permissions for your GitHub Organization.
Simple steps to set up a 2 Node Kubernetes Cluster using Kubeadm
A quick tutorial on setting up a 2 node Ubuntu bare metal Kubernetes cluster using kubeadm on standalone local virtual machines, Google VM Instances, AWS instances or any other cloud provider’s compute service.
5 Different ways to authenticate with AWS
AWS supports multiple ways of authenticating users based on their context. This article shows various ways of authenticating to AWS using credentials, tokens, SSO and others.
How to update a user owned public EBS Snapshot to private using AWS CLI
User owned public EBS snapshots are accessible to any AWS user. If you have created a public EBS snapshot that may contain sensitive or private information and would like to change it to a private snapshot using AWS CLI, follow this step-by-step guide.
How to update a user owned public EBS Snapshot to private
User owned public EBS snapshots are accessible to any AWS user. If you have created a public EBS snapshot that may contain sensitive or private information and would like to change it to a private snapshot, follow this step-by-step guide.
How to Make a GitHub Repository Private (Step-by-Step 2026)
Change a public GitHub repository to private in 4 clicks. Step-by-step guide with screenshots — covers visibility settings, what happens to forks, and collaborator access.
How to use Steampipe to extract information for DigitalOcean
Once configured to work with DigitalOcean, Steampipe pulls metadata about resources running in the cloud which we can then query using SQL queries.
How to authenticate Steampipe with DigitalOcean
This article shows how to configure Steampipe to work with DigitalOcean.
How to encrypt EBS Snapshot in AWS
Encrypting EBS snapshots adds a layer of security and also helps in meeting compliance requirements. This article provides a walkthrough of how to encrypt an EBS snapshot in AWS.
How to encrypt EBS Snapshot using AWS CLI
Encrypting EBS snapshots adds a layer of security and also helps in meeting compliance requirements. This article provides a walkthrough of how to encrypt an EBS snapshot in AWS.
Setting up Steampipe to perform cloud information gathering
Steampipe is a tool that allows for data collection from various cloud providers and exposing them as APIs via a high-performance relational database, giving you the ability to write SQL-based queries to explore data.
Using a GitHub runner to perform Secrets Scanning using TruffleHog
This document takes you through the steps required to run a local GitHub runner and use that to scan GitHub repositories for secrets using TruffleHog.
Allowing non AWS workloads to access AWS services using AWS IAM Roles Anywhere
AWS IAM Roles Anywhere is a feature that allows non AWS workloads (servers, containers, apps etc.) to obtain temporary security credentials in IAM. These workloads can use the same IAM policies and IAM roles that AWS compute resources use with AWS applications to access AWS cloud.
How to update IMDSv1 to more secure IMDSv2 on AWS
Having IMDSv1 enabled on your instances allows attackers to use vulnerabilities like SSRF to gain access to sensitive information of your instances. In this article we will walk through the steps to update an EC2 instance from IMDSv1 to IMDSv2 using AWS CLI.
How to Enable MFA for AWS Root User (Console + CLI)
Step-by-step guide to enabling multi-factor authentication on your AWS root account. Covers virtual MFA device setup, hardware keys, and why root MFA is the
How to remove AWS Root user access keys
Having an access key for the Root user poses the risk of being misused or stolen, since this user has unrestricted access in the account. If your Root user also has access keys that you would like to remove, here is a step-by-step guide to do so.
Restricting access to Elasticsearch/Opensearch service
Elasticsearch/OpenSearch domains that are not required to be openly accessible should be created without a public endpoint to prevent arbitrary public access to the domain.
Enforce SSL/TLS for all incoming connections on CloudSQL Database Instances
Unencrypted database connections allow attackers on the network to perform man-in-the-middle attacks that can be used to steal information and even modify data. In this article we will take a quick look at how to enable encryption for incoming connections on CloudSQL databases.
How to enable Prevent Password Reuse policy in AWS
Prevent password reuse policy can be easily enabled in AWS. This helps in preventing users from reusing their old passwords after expiry or when password change operations are performed. This article provides a step by step walkthrough of how you can enable Prevent Password Reuse policy on AWS, both in video and text for your preferred medium of learning.
How to restrict access to public Cloud SQL database instances
Publicly exposed database instances can attract a lot of brute force attacks and may lead to a compromise of the database as well. If a database requires a public IP address, then one must make sure to restrict the public access to only trusted IP addresses.
Migrating an unencrypted RDS database to an encrypted one
Encrypting data at rest is a security best practice. RDS instances must also be encrypted. If you have an existing unencrypted RDS instance, this article will guide you on how you can migrate it to an encrypted one.
How to restrict access to your publicly accessible RDS Instance
Exposing AWS RDS database instances to the internet is generally a bad security practice since it contains data meant to be consumed by specific instances only. If that is the case for you as well, follow this article to see how you can restrict access to your RDS Instances.
Restricting access to your RDS snapshots
Public AWS RDS database snapshots are accessible to any AWS user. If you have created a public RDS snapshot that may contain sensitive or private information and would like to change it to a private snapshot, follow this step-by-step guide.
How to Encrypt AWS EBS Volume
EBS volumes are not encrypted by default. Encrypting these adds a layer of security to the data stored on it.
How to update AWS AMI permission from Public to Private
A cloud administrator can create an instance with all tools and software installed and then make an image out of this to be reused in the future. This image could contain proprietary data and code etc. that could be abused by an attacker if they gain access to the AMI.
Allowing IAM users to access AWS EKS using kubectl
For any managed service on AWS, the more you rely on IAM for authentication and authorization, the more you reduce your attack surface. In this article, we will see how we can create users of various permission levels in an AWS EKS cluster and map the user to an AWS IAM user.
How to secure AWS S3 buckets with sensitive data
A lot of users, organizations and even nation states and governments utilize the versatility of Amazon’s S3 service. Any data that is stored on S3 needs to maintain the basic tenets of security, which include encryption of data at rest, in motion, authorization to access the data and assurance that actions performed on the data are auditable. In this article, we will take a look at how we can use the features provided by S3 to ensure our data is secure on the cloud.
An introduction to Service Control Policies (SCPs) in AWS
This article gives introduction on Service Control Policies (SCPs) in AWS .
Attacking Modern Environments Series: Attack Vectors on Terraform Environments
Terraform is a popular IAC orchestrator that is widely used for standardising and executing infrastructure deployments, but since it has privileges on the cloud platforms, Mazin Ahmed shares why it is important to understand which attack vectors exist, and what can be done about them.
Cloud Security Orienteering
A presentation on how one can quickly get familiar with new cloud environments and accelerate the process of identifying security issues and addressing them.
Scanning IPv6 with v6disc
`v6disc` is a shell script that was created to quickly and automatically discover IPv6 hosts with the option to ping or run nmap against discovered hosts.
Scanning IPv6 with Masscan
Masscan is an Internet-scale port scanner. It can scan the entire Internet in under 5 minutes, transmitting 10 million packets per second, from a single machine. This is thanks to it being written in C, having its own ad-hoc TCP/IP stack and asynchronous transmission similar to port scanners like scanrand, unicornscan, and ZMap.
How to create a Virtual Machine on Google Cloud
Creating Virtual Machines on cloud platforms is one of the most common activities. This article is a quick guide for creating a Virtual Machine on Google Cloud.
Scanning IPv6 with RustScan
RustScan is a port scanning tool for scanning IPv6 networks. This article features a quick guide on setting up and using RustScan’s port scanning capabilities.
Identifying Toxic Combinations of Permissions in Your Cloud Infrastructure
Excessive permissions in cloud accounts can significantly increase the attack surface. It is important to understand what permissions are assigned to various users, groups, roles, service accounts versus what permissions they actually need.
Getting started with AWS ELB - Network Load Balancer
This article is a quick introduction to network load balancing and how to create a Network Load Balancer on AWS.
Getting started with AWS ELB - Application Load Balancer
Elastic Load Balancing (ELB) automatically distributes incoming application traffic across multiple targets and virtual appliances in one or more Availability Zones (AZs). In this article we will take a look at how to create an Application Load Balancer on AWS.
Escalating privileges in Google Cloud, from app to cloud access
A short blogpost that shows an exploitation scenario where an attacker, who has managed to gain SSRF or code execution capabilities, can leak tokens and escape to the Google Cloud platform.
Scanning IPv6 with fi6s
fi6s is a port scanning tool for scanning IPv6 networks. This article features a short guide on setting up and using fi6s’s port scanning capabilities.
How to create a new Pub/Sub Topic on Google Cloud
Pub/Subs are popularly used for asynchronous communication between applications. This article is a quick walkthrough of how you can create a Pub/Sub Topic on Google Cloud.
How to create a new Project in Google Cloud
Projects in Google Cloud help in organising all the Google Cloud Resources. This article provides a quick hands-on guide on how you can create a new Project on Google Cloud. Akash Mahajan.
Exploiting the O365 Duo 2FA Misconfiguration
An interesting talk on understanding the O365 Duo 2FA misconfiguration and how it can be detected and remediated.
How to transfer files between AWS S3 and AWS EC2
A simple and quick walkthrough of how you can transfer files between AWS EC2 and AWS S3.
Configuring AWS Load Balancers to protect against HTTP Desync attacks
HTTP Desync attacks are a category of attacks on a system of proxies and load balancers when multiple devices in the chain parse parts of the HTTP request differently, resulting in tampering of legitimate HTTP sessions and bypassing application level security. AWS offers protection against these attacks in their Load Balancer service that prevents exploitation.
Scanning IPv6 with Nmap
Nmap is amongst the popular network discovery utilities discovering hosts and services on the network. This article provides a walkthrough for getting started with Nmap for scanning IPv6 addresses.
How to set up EFS and use with multiple instances in different VPCs
This academy article provides hands-on guidance on how you can set up an AWS EFS and use it with instances in different VPCs.
Create, attach, and detach EBS volumes
This academy article provides hands-on guidance on how you can create, attach, and detach EBS volumes to your EC2 instances on AWS.
How to set up an S3 bucket on AWS
This academy article provides hands-on guidance on creating an S3 bucket on AWS. Follow the steps in this article to set up your new S3 bucket
AWS EBS vs S3 vs EFS: Differences & Use Cases
EBS, S3, and EFS are three popular storage services provided by AWS. In this article, we take a look at each of these services and their use cases.
Detection Challenges in Cloud Connected Credential Abuse Attacks
Blurring of traditional perimeters with the emergence of cloud has led to rise of new threats. This talk by Rod Soto takes us through some of the attack scenarios and how defenders can implement detection to address these new threats.
Tools for Scanning IPv6 networks
IPv6 networking is increasingly being adopted by businesses and organisations around the world. Though there are many popular scanners for IPv4, here’s a list that covers some of the tools that can be used to scan IPv6 networks.
Top 10 security best practices for your GitHub organisation account
A list of top 10 security best practices to improve the security of your GitHub organisation.
Attack Vectors for APIs Using AWS API Gateway Lambda Authorizers
On AWS, Lambda Authorizers are frequently used with API Gateway, however, one must be careful when working with the policy documents for Lambda Authorizers. This tech talk by Alexandre & Leonardo takes you through interesting examples to showcase the attack vectors for APIs using the AWS API Gateway Lambda Authorizers.
Shift Left Using Cloud: Implementing baseline security into your deployment lifecycle
Implementing the principle of Shift Left in terms of security into your deployment lifecycle can help in finding and fixing vulnerabilities in the early stages making it more efficient to address security issues.
Securing your GoDaddy Accounts
Domain and website are an important part of an organisations’ identity and brand on the Internet, hence it is important to secure your accounts with your domain registrar. In this article, we discuss some of the ways to protect your accounts on one of the most popular domain registrars - GoDaddy.
An Attacker's Approach to Pentesting IBM Cloud - fwd:cloudsec 2021
A walkthrough of the slides presented during the fwd:cloudsec 2021 conference with details of findings and observations across different resources within the IBM cloud platform.
Hunting for AWS Exposed Resources
Misconfigured cloud services exposed to the internet is a very common security issue. This video talks about how exposed AWS resources can be discovered and some interesting insights from the speaker Felipe Pr0teus indicating the importance of securing your cloud resources.
AWS cloud attack vectors and security controls
An insightful presentation by Kavisha Seth on understanding and identifying different attack vectors on AWS and learning about various security controls that can be implemented.
Security measures against SSRF attacks for AWS EC2 instances
In this article you will learn about some preemptive security measures that can be implemented for AWS EC2 instances against SSRF attacks.
Understanding common Google Cloud misconfigurations using GCP Goat
A hands-on introduction and walkthrough of GCP Goat - an intentionally vulnerable GCP environment to help understand common misconfigurations in Google Cloud and how attackers can take advantage of it.
5 Things to Consider When Using AWS Elastic IP Addresses
Learn the key considerations and best practices for using AWS Elastic IP addresses effectively
Fixing the default insecure network connection option for RDS instances
The AWS RDS service, by default, does not enable transport layer security, allowing clients to connect insecurely if they want to. This article shows how SREs, DevOps, and RDS administrators can lower the risk that this default configuration poses.
Automate scanning of GitHub repos for secrets with GitHub Actions
Secrets like passwords, API keys, access keys, etc. can often creep into our source code repositories intentionally or unintentionally, hence it is essential to ensure that we spot them at the earliest. In this article, we look into how to automate scanning of GitHub repositories for secrets using GitHub Actions.
How to securely configure an AWS EC2 instance
AWS EC2 is one of the most popular and widely used services from AWS. With a variety of options available to tailor the EC2 instances as per one’s requirements, it also poses a risk of introducing security gaps in the form of misconfigurations or insecure defaults. In this article we discuss some of the ways that can help configure our EC2 instances securely.
Top 10 security best practices for securing data in Amazon S3
A list of top 10 security best practices created based on our experience as attackers and defenders that can be employed to dramatically enhance the security of AWS S3 service.
Enumerating Users and their Access levels in 1Password
1Password is a SaaS that is used to securely store and share credentials across team members. This article shows how you can perform a user audit and identify access or rogue users within your organisation.
-on-the-cloud/1673703146-how-to-patch-the-pwnkit-vulnerability-(CVE-2021-4034)-on-the-cloud-thumbnail.png)
How to Patch the Pwnkit vulnerability (CVE-2021-4034) on the Cloud
A quick guide on detecting and fixing the recently discovered Pwnkit (CVE-2021-4034) Local Privilege Escalation vulnerability on standalone and cloud based virtual machines.
A detailed guide on protecting against the 8KB AWS WAF limitation
Google Cloud Armor has a documented limitation related to the maximum size of an HTTP POST request body the service is able to inspect and block. Attackers can use this limitation to bypass the protection provided by Cloud Armor and potentially exploit vulnerabilities that may be present in an underlying web application. This article will take you through how Cloud Armor rules can be configured to appropriately mitigate the risk due to the limitation.
5 ways to connect to your GCP VM instances using SSH
GCP provides various ways by which you can SSH to a Linux compute instance, especially useful when you have firewall rules preventing external access. This article shows the 5 ways to connect to a GCP VM instance using SSH.
What is Multi-Factor Authentication in AWS?
A detailed article that describes what Multi-Factor Authentication systems are, how they increase the security of the system they protect and what it means in the context of the AWS cloud.
How to perform an IAM Security Audit in AWS
A step by step guide to show how a security audit of AWS IAM can be performed to identify users attributes like unrotated keys, IAM password policies, access and much more.
Deploying web applications with GitHub Actions
A guide on deploying your first (or second, or third or …) application from a code repository to a server via the awesome GitHub Actions workflow.
How to perform a EC2 Vulnerability using Amazon Inspector
A guide on how to perform an EC2 Vulnerability Scan using Amazon Inspector with the console and the CLI.
How to do a complete security audit of your Mongo Cloud account
A security audit allows you to collect information about a system which can then be analysed to identify if there are security weaknesses. This article describes how you can perform a security audit of your Mongo Cloud account.
How to get all public IP addresses in your AWS account
The knowledge of all public IP addresses across different services within AWS is a good way to get started with understanding what the attack footprint of an organisation looks like. This article describes fetching this information using both, the web console and the CLI.
Getting started with AWS CloudTrail to monitor for security-sensitive APIs
CloudTrail is a service offered by AWS to monitor and record all actions taken within an AWS account. This article describes how you can get started with AWS CloudTrail to monitor for security sensitive APIs.
Using log4jscanwin to identify Log4j vulnerabilities on Windows machines
A step-by-step guide on how to identify Log4j vulnerabilities on Windows machines using log4jscanwin
DevSecOps - Scan GitHub org. repos for secrets
Developers may sometimes, accidentally or due to the lack of security knowledge, store secrets, keys or passwords within code repositories. These may then get leaked over the Internet, resulting in attackers taking over accounts or accessing sensitive information. This article describes how you can scan your Github org repos for secrets.
How to find vulnerable log4j instances across your AWS EC2 instances
A guide to help you discover vulnerable Log4j packages across multiple Linux machines using scripting and the AWS SSM to run commands remotely.
Authentication Bypass in Apache Airflow - CVE-2020-17526 and AWS Cloud Platform compromise
An authentication bypass within Apache Airflow allowed an attacker to login as any user in the Airflow system. Post exploitation within the app, led to a full cloud account compromise on AWS.
IAM Bad: Privilege Escalation using Misconfigured Policies in AWS IAM (Webinar)
A walkthrough of the slides covered as part of our Star Wars Day special webinar on IAM policy misconfigurations that can lead to privilege escalations and a takeover of the target AWS account.
Rogue One: A Certified Kubernetes Administrator (CKA) Exam Story
My journey and experience with how I approached the CKA exam, failed it, learnt from my failure and passed it in my second attempt. Tips and Tricks included!
Part 9 - Mapping the MITRE ATT&CK framework to your Kubernetes cluster: Impact on the Cluster
This is the ninth and the last part of a series on the MITRE ATT&CK framework for Kubernetes, covering the Impact tactic with examples.
Part 8 - Mapping the MITRE ATT&CK framework to your Kubernetes cluster: Lateral Movement
This is the eighth part of a nine part series on the MITRE ATT&CK framework for Kubernetes, covering the Lateral Movement tactic with examples.
Part 7 - Mapping the MITRE ATT&CK framework to your Kubernetes cluster: Discovery
This is the seventh part of a nine part series on the MITRE ATT&CK framework for Kubernetes, covering the Discovery tactic with examples.
Part 6 - Mapping the MITRE ATT&CK framework to your Kubernetes cluster: Credential Access
This is the sixth part of a nine part series on the MITRE ATT&CK framework for Kubernetes, covering the Credential Access tactic with examples.
Part 5 - Mapping the MITRE ATT&CK framework to your Kubernetes cluster: Defense Evasion
This is the fifth part of a nine part series on the MITRE ATT&CK framework for Kubernetes, covering the Defense Evasion tactic with examples.
Part 4 - Mapping the MITRE ATT&CK framework to your Kubernetes cluster: Escalation
This is the fourth part of a nine part series on the MITRE ATT&CK framework for Kubernetes, covering the Privilege Escalation tactic with examples.
Part 3 - Mapping the MITRE ATT&CK framework to your Kubernetes cluster: Persistence
This is the third part of a nine part series on the MITRE ATT&CK framework for Kubernetes, covering the Persistence tactic with examples.
Part 2: Mapping the MITRE ATT&CK framework to your Kubernetes cluster: Execution
The MITRE ATT&CK framework provides a knowledgebase of adversary tactics and techniques. In this post, we see how Microsoft applied the attack matrix to K8S.
Part 1: Mapping the MITRE ATT&CK framework to your Kubernetes cluster: Initial Access
The MITRE ATT&CK framework provides a knowledgebase of adversary tactics and techniques. In this post, we see how Microsoft applied the attack matrix to K8S.
A Technical Analysis of the AWS CloudShell service
A quick technical analysis of the AWS CloudShell service that provides a pre-configured shell on the cloud with access to your AWS account.
Impact of CVE-2020-15257 on your Docker and Kubernetes environments
A new vulnerability named CVE-2020-15257 has been discovered in the networking namespace. Our blog covers the details.
Are you missing patching your clusters because of the new Docker hub limits?
Docker announced new limits on image pulls from its Hub. We examine how it may impact your K8s operations.