fwd:cloudsec Courses

No IP, No Problem - Exfiltrating Data Behind IAP

Uncover critical IAP misconfigurations that enable data exfiltration in GCP environments, bypassing network controls without public internet traffic through real-world examples.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

Happy Little Clouds - Painting Pictures with Microsoft Cloud and Identity Data

Discover how to effectively detect and investigate Microsoft cloud and identity threats by mastering data source assessment and threat storytelling methodologies.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Securing Remote MCP Servers

Discover best practices for securing Model Context Protocol (MCP) servers in cloud environments, covering deployment strategies, authentication methods, and threat mitigation.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Data Perimeter Implementation Strategies - Lessons Learned Rolling Out SCPs/RCPs

Discover real-world strategies for implementing AWS SCPs and RCPs at enterprise scale, overcoming challenges like dynamic VPCs, CI/CD integration, and access verification.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Putting Workload Identity to Work - Taking SPIFFE Past Day 0

Discover practical strategies for implementing SPIFFE workload identity beyond initial setup, replacing legacy authentication with cryptographic identities in existing infrastructure.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

IAM Roles Anywhere - Now for Everyone with Let's Encrypt

Discover how to deploy IAM Roles Anywhere using Let's Encrypt for secure device enrollment without expensive PKI solutions, including certificate mapping and abuse detection.

• YouTube
• 20 minutes
• Self-Paced
• Free Video

Read Between The Logs - A New Vulnerability in Gemini Cloud Assist Proves the Threat is Real

Discover a critical vulnerability in Google's Gemini Cloud Assist where attackers embed malicious prompts in logs to exploit AI tools and deceive defenders into phishing attacks.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Who Watches the Watchmen? Stealing Credentials from Policy-as-Code Engines and Beyond

Explore novel security vulnerabilities in policy-as-code engines, focusing on credential theft techniques, DNS tunneling exploits, and defensive measures for protecting cloud infrastructure deployments.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

How to 10X Your Cloud Security Without the Series D

Discover practical strategies and actionable insights for scaling cloud security programs efficiently, covering current best practices and future trends in infrastructure protection.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

Doing Bad Things for the Right Reasons - A Look at the AWS Vulnerability Disclosure and Remediation Process

Explore AWS vulnerability disclosure processes, from research approaches and coordinated disclosure to embargo periods and real-world examples of responsible security findings reporting in cloud environments.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

Hidden Among the Clouds - Discovering and Analyzing Undocumented AWS APIs

Discover methodologies for identifying undocumented AWS APIs, their security implications, and learn to use open-source tools for detecting hidden cloud vulnerabilities and potential attack vectors.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

Hidden in Plain Sight - Abusing Entra's Administrative Units

Discover how Administrative Units in Entra ID can be exploited for tenant persistence, including obscure parameters and restrictions that attackers leverage, plus detection and remediation strategies.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

Building Your Own CloudTrail with AWS IAM and Cedar Authorization Framework

Discover how to implement AWS IAM principles and Cedar authorization framework to build secure cloud services with comprehensive audit logging capabilities, inspired by CloudTrail architecture.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

Kubernetes Audit Log Gotchas: Challenges in Multi-Cloud Detection and Forensics

Explore practical challenges and solutions for managing Kubernetes audit logs across cloud providers, including logging policies, format differences, and their impact on security detection capabilities.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Cloud-Conscious Tactics, Techniques, and Procedures (TTPs) - An Overview

Discover common cloud attack techniques and defense strategies through real incident response cases, focusing on unauthorized access, data theft, and ransomware deployment in cloud environments.

• YouTube
• 27 minutes
• Self-Paced
• Free Video