fwd:cloudsec Courses

Introducing GRC Engineering - A New Era of AWS Compliance

Discover how GRC Engineering transforms AWS compliance from manual processes into automated, strategic assets using native tools and infrastructure as code practices.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Rebuilding ROADRecon for the Modern Entra Environment

Discover how to modernize ROADRecon for Entra environments, transitioning from deprecated Azure AD Graph to Microsoft Graph API while exploring OAuth security implications.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Trust Issues - What Do All These JSON Files Actually Mean?

Discover how to decode AWS IAM policies and understand real-world permissions across your cloud environment without manually parsing complex JSON configurations.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Exploiting nOAuth - Critical OpenID Connect Implementation Flaws in SaaS Applications

Explore nOAuth attacks and OpenID Connect flaws that enable SaaS application takeover, plus learn mitigation strategies from real-world exploitation examples.

• YouTube
• 49 minutes
• Self-Paced
• Free Video

ECS-cape - Hijacking IAM Privileges in Amazon ECS

Discover how to exploit an undocumented Amazon ECS protocol vulnerability that enables low-privileged roles to hijack higher-privileged container IAM permissions on shared EC2 instances.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

whoAMI - Discovering and Exploiting a Large-Scale AMI Name Confusion Attack

Uncover the whoAMI attack technique that enables remote code execution across thousands of AWS accounts through AMI name confusion vulnerabilities and learn defense strategies.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

Not So Secret - The Hidden Risks of GitHub Actions Secrets

Uncover hidden security risks in GitHub Actions secrets and learn practical strategies to protect CI/CD pipelines from misconfigurations and unauthorized access.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

Detecting the Undetectable - Threat Hunting in Appliance Environments

Discover advanced threat hunting techniques for appliance environments using cloud metadata analysis to uncover persistent threats and enhance security defenses against hard-to-detect attacks.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

Farewell False Positives - Building Trustworthy AI for Infrastructure as Code Analysis

Discover practical techniques for building reliable AI systems that analyze Terraform and CDK code, eliminating hallucinations and false positives in cloud security reviews.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Patience Brings Prey - Lessons Learned from a Year of Threat Hunting in the Cloud

Discover vendor-agnostic cloud threat hunting strategies combining hypothesis-driven investigations, TTP-based hunts, and anomaly detection to uncover sophisticated cloud-native attacks.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

The Good, The Bad, and The Vulnerable - Breaking Down GCP Tenant Projects

Uncover critical vulnerabilities in GCP Tenant Projects through real-world exploitation scenarios and learn defensive strategies against multi-tenant architecture attacks.

• YouTube
• 20 minutes
• Self-Paced
• Free Video

Inside Microsoft's Battle Against Cloud-Enabled Deepfake Threats

Explore Microsoft's legal battle against LLMjacking threat actors who exploit cloud AI services to create harmful deepfakes, learning defense strategies for this evolving threat.

• YouTube
• 23 minutes
• Self-Paced
• Free Video

Inviter Threat - Managing Security in a New Cloud Deployment Model

Explore vendor-managed cloud deployments, their security risks, and mitigation strategies for organizations balancing operational savings with expanded attack surfaces.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

Staying Sneaky in the Office 365 - Exploiting Hidden SharePoint APIs for Azure Lateral Movement

Explore hidden SharePoint APIs to understand attack vectors and defense strategies in Microsoft 365 environments, bypassing Graph API detection methods.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

I Didn't Register for This - What's Really in Google's Artifact Registry?

Uncover critical vulnerabilities and secrets hidden in Google's Artifact Registry container images through comprehensive security research findings.

• YouTube
• 25 minutes
• Self-Paced
• Free Video