Google Cloud Hacking Red Team Perspective!
08/02/23 • 32 min
Google cloud hacking or pentesting is very different to other popular cloud service providers like aws or azure. In this episode we had Shannon McHale (Mandiant now Google Cloud) to talk about how she approaches pentesting a google cloud environment and how you can too.
Episode YouTube: Video Link
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Socials: Shannon McHale's Linkedin (Shannon's Linkedin)
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
Cloud Security Newsletter
- Cloud Security BootCamp
Spotify TimeStamp for Interview Questions
A word from our sponsors - you can visit them on snyk.io/csp
(00:00) Introduction
(03:38) A bit about Shannon McHale
(05:31) What is Red Teaming?
(06:42) Red Teaming in the Cloud
(07:50) Methodology behind Red Teaming
(09:32) Pentesting in Goole Cloud
(10:28) Low hanging fruits in Google Cloud
(14:36) GCP storage
(16:09) Red Team Assessment in Google Cloud
(17:08) The importance of Metadata
(18:17) Recommendations for Blue Teamers
(22:03) How to get started in Red Teaming?
(26:06) Tools or Research that stood out for Shannon
(27:42) GCP Resources that can be exposed
(29:15) Resources to learn about Cloud Red Teaming
(30:37) The Fun Questions
These are some of the resources Shannon found helpful to learn about Pentesting in Cloud along with her own GitHub link
See you at the next episode!
Google cloud hacking or pentesting is very different to other popular cloud service providers like aws or azure. In this episode we had Shannon McHale (Mandiant now Google Cloud) to talk about how she approaches pentesting a google cloud environment and how you can too.
Episode YouTube: Video Link
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Socials: Shannon McHale's Linkedin (Shannon's Linkedin)
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
Cloud Security Newsletter
- Cloud Security BootCamp
Spotify TimeStamp for Interview Questions
A word from our sponsors - you can visit them on snyk.io/csp
(00:00) Introduction
(03:38) A bit about Shannon McHale
(05:31) What is Red Teaming?
(06:42) Red Teaming in the Cloud
(07:50) Methodology behind Red Teaming
(09:32) Pentesting in Goole Cloud
(10:28) Low hanging fruits in Google Cloud
(14:36) GCP storage
(16:09) Red Team Assessment in Google Cloud
(17:08) The importance of Metadata
(18:17) Recommendations for Blue Teamers
(22:03) How to get started in Red Teaming?
(26:06) Tools or Research that stood out for Shannon
(27:42) GCP Resources that can be exposed
(29:15) Resources to learn about Cloud Red Teaming
(30:37) The Fun Questions
These are some of the resources Shannon found helpful to learn about Pentesting in Cloud along with her own GitHub link
See you at the next episode!
Previous Episode
Cloud Security in the BoardRoom - CISO Perspective with Phil Venables
CISOs in organizations that are going through digital transformation have a responsibility of educating the board on how Cloud Security is measured and improved on to manage the risk posture of the organization. We had Phil Venables, CISO of Google Cloud share from his experience of serving as a CISO for so many years on how to best share cybersecurity and cloud security metrics with the c-suite and the board.
Episode YouTube Video Link
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Socials: Phil Venable's Linkedin (Phil's Linkedin)
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
Cloud Security Newsletter
- Cloud Security BootCamp
Spotify TimeStamp for Interview Questions
A word from our sponsors - you can visit them on snyk.io/csp
(00:00) Introduction
(03:02) A bit about Phil Venables
(04:17) Are boards talking about Cloud Security?
(05:47) Security Metrics to show to the board
(07:48) Are Security Metrics seasonal?
(10:23) Aligning security metrics to business goals
(13:59) Educating the board about Cloud Security
(15:50) CISOs should be braver
(18:42) 3 Security Metrics to start with
(25:25) Setting the risk appetite as a organisation
(27:11) Essential attributes for a CISO
(29:14) What makes a successful security program?
(32:18) Skillsets required to become a CISO
(36:49) The fun questions
See you at the next episode!
Next Episode
Network Pentest 2.0 : The Cloud Pentest Revolution
Cloud Security Pentest is not just a Cloud configuration review ! Blackhat 2023 & Defcon 31 conversations included Cloud Security Podcast asking traditional and experienced pentesters about their opinion on cloud security pentesting and the divide was between it being a config review or a product pentest. For this episode we have Seth Art from Bishop Fox to clarify the myth.
Episode YouTube: Video Link
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Socials: Seth Art's Linkedin (Seth Art Linkedin)
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
Cloud Security Newsletter
- Cloud Security BootCamp
Spotify TimeStamp for Interview Question
(00:00) Introduction
(05:17) A bit about Seth Art
(06:44) Network vs Infrastructure Security Pentest
(08:00) Internal vs External Network Security Pentest
(10:26) Assumed vs Objective Based Pentest
(12:51) Is network pentest dead?
(14:04) How to approach network and cloud pentests?
(20:12) Cloud pentest is more than config review
(24:04) Examples of cloud pentest findings
(30:07) Scaling pentests in cloud
(32:25) Traditional skillsets to cloud pentest
(36:58) A bit about cloudfoxable
(39:31) Cloud pentest and Zero Trust
(40:54) Staying ahead of CSP releases
(44:31) Third party shared responsibility
(47:35) 1 fun question
(48:36) Boundary for cloud pentest
(52:21) Last 2 fun questions
These are some of the resources that Seth shared during the episode along with the tools he has created
See you at the next episode!
If you like this episode you’ll love
Episode Comments
Generate a badge
Get a badge for your website that links back to this episode
<a href="https://goodpods.com/podcasts/cloud-security-podcast-175178/google-cloud-hacking-red-team-perspective-32110080"> <img src="https://storage.googleapis.com/goodpods-images-bucket/badges/generic-badge-1.svg" alt="listen to google cloud hacking red team perspective! on goodpods" style="width: 225px" /> </a>
Copy