Head in the clouds

Virtualisation technology in the cloud has become a huge resource to leverage, as it promises high availability and access to resources from anywhere … meanwhile, none of the cloud suppliers protect the data under their care. They protect the security of the cloud, not the data in the cloud. Responsibility for the CIA (confidentiality, integrity, and availability) of the data in the cloud, remains with the data owner. Data in the cloud is running on someone else’s server, and the data is often in the clear, in motion and in use.

---

Preparation

• Build a local testlab
• Reconnaissance
• Enumeration

Notes on techniques

• Introduction
• Challenges
• Account and privilege attacks
• Cloud-centric attacks
• Abusing misconfigurations
• Hacking CI/CD pipelines

CTFs and challenges

• Introduction
• Bust-a-Kube
• flAWS 2

---