Practical Cloud Security for AWS Infrastructure
Two-Day Interactive (Online) Training - OWASP New Zealand Day 2022
With the rapid adoption of cloud-hosted infrastructure, there is an innate need for skilled personnel to continuously defend the organizations against advanced threats. While AWS onboarding is relatively streamlined, the continuous security of AWS infrastructure and its services is a whole new ball game.
- Session 1: Tuesday and Wednesday, 15-16 February 2022
- Session 2: Tuesday and Wednesday, 5-6 July 2022
Time: 8:45 a.m. to 5:30 p.m. (NZDT)
Instructor: Jayesh Singh Chauhan
Course Fee: NZ $900.00 (plus GST and ticketing fees)
Registration Site: https://events.humanitix.com/owaspnz2022-training
The massive adoption of cloud services with ever-growing numbers of AWS services has left the security team with the lion’s share of work to identify, analyze and secure an organisation’s assets across cloud infrastructure. Multiple cloud accounts have added more stress to the whole equation of securing cloud infrastructures. The security team has to cater to the growth and adoption of different services in the cloud and make sure that there is no hole left to get into the infrastructure and do lateral movement.
Cloud Infrastructure security has multiple pieces including but not limited to: threat modeling the infrastructure; understanding holes in services as they get adopted; writing proactively hardened policies; and making sure that, if someone misses a configuration, then proactively monitor the configuration and network to enforce security back, and do all of this while enabling the business. While infrastructure configuration has to be monitored and secured on a regular basis, hardening OS, CI/CD, containers, and Kubernetes clusters also become an integral part of the security team’s realm. “As many services” is directly proportional to “As many avenues to abuse”!
This training approaches cloud security with a multi-layer approach by understanding the perimeter of assets/services, securing cloud-native security services, and getting into the detailed security of every important asset/service/instance.
While cloud-native security solutions are relatively easier to implement and are optimized as per their respective environments, this training doesn’t limit the security to native solutions. The training gives an equal amount of open-source options to implement a similar or better security posture without depending on cloud-native security services, and enables the organisation to have more granular control over the security of their infrastructure.
Day One - Tuesday
- Introduction to AWS and its services
- Securing IAM
- Role vs Policy
- Auditing cloud resources
- AWS Trusted Advisor
- AWS Guard Duty and AWS Inspector
- AWS WAF
- WAF testing
- AWS Lambda Security
Day Two - Wednesday
- AWS attack case-studies
- Setting up a SIEM
- Hardening OS
- CI/CD-enforced security
- Docker Security
- Kubernetes Security
- Secret/Sensitive Key Detection in code
- Cloud CTF
Why is this class needed?
With working from home as our “new normal,” the industry has aggressively adopted AWS infrastructures. However, security up-skilling hasn’t happened at the same pace. This training is aimed at bridging this gap.
- For cloud infrastructure security, defensive skills are more important and hence I believe that there should be more defensive training for cloud.
- This training focuses more on practical and hands-on exercises where participants can play around and acquire the skillset required to successfully manage cloud security for their organizations.
- Security posture management of AWS
- Cloud attack vectors and their implications
- Leveraging open sources for granular control of security
Security Analysts, System Administrators, Pen Testers, Cloud Engineers, DevOps Engineers, or anyone interested in securing AWS
Skill Level: Basic/Intermediate
What You’ll Need to Bring to the Class
- Basic understanding of linux, ssh, and git
- A working AWS account, with a credit card attached to it
- A laptop on which you have administrative privileges (to install tools), with a minimum of 4GB RAM
What You’ll Receive as Part of the Class
- Practice Materials
- CTF Solutions
- Cheat Sheets for security AWS infrastructure
Your Instructor - Jayesh Singh Chauhan
Jayesh Singh Chauhan is a security professional with ten years of experience in the security space and he is the founder of Cloud Village at DEF CON.
In the past, he has been part of the security teams of PayPal, PwC and currently works as the Director of Product Security at Sprinklr Inc. He has been a trainer at conferences like nullcon and has trained the defence forces. He has also authored Cloud Security Suite, OWASP Skanda, RFID_Cloner and has presented his work in BlackHat Arsenal (USA, EU Asia), DEF CON DemoLabs, HackMiami, c0c0n, OWASP Global, and OffZone Moscow.