Episode 17: How to do penetration testing in cloud application

Episode 17 August 02, 2020 00:37:03
Episode 17: How to do penetration testing in cloud application
SilverLining IL
Episode 17: How to do penetration testing in cloud application
/

Hosted By

Moshe Ferber Ariel Munafo

Show Notes

Attendees

Guest: Oz Avenstein

Guest Title:  Founder

Company:  Avensec

Abstract

Penetration tests are one of the strongest controls that we use. It is testing the overall resilience of our application and allows us to be more confident in our workloads. But in the cloud era, cloud applications pen testing needs to be coordinated with the providers. In this episode we talk with Oz Avenstein, an application security expert, about the challenges of cloud penetration testing and how to do it correctly.

Timing:

0.50 introducing our guest

3.40 How is cloud penetration tests different from regular pen tests?

5.01 elaborating about IaaS/PaaS particular pen test policies 

8.45 pen testing SaaS applications 

11.05 relaying on 3rd party pen testing

12.02 cloud pen test considerations and phases

17.35 the actual pen testing 

21.20 the reporting phase

23.40 incorporating pen test into applications development cycle 

34:00 Summary and last words

 

Other Episodes

Episode 52

July 13, 2022 00:32:36
Episode Cover

SilverLining Episode 52: Securing K8’s Deployments

Guest: Leonid Sandler Guest title: CTO, Armosec Topic: Securing K8’s Deployments Language: English   Abstract As K8’s adoption grows and matures, we sat down with Leonid Sandler, CTO and Co-Founder of ARMO, to talk about K8’s security - starting from the shared responsibility model, going through the initial configuration and deployment, and all the way to building a runtime protection solution.  ARMO github page - https://github.com/armosec/kubescape ...

Listen

Episode 23

August 04, 2020 00:47:42
Episode Cover

Episode 23: Understanding Microsoft Cloud Security Pillars

Attendees Guest: Yoad Dvir Guest title: Security Lead, Central and Eastern Europe Company: Microsoft Abstract Microsoft security portfolio has been growing and diversifying in the last couple of years, adding more capabilities at various areas of information security. In order to better understand Microsoft strategy and offering, we talked with Yoad Dvir, Cyber Security Lead at Microsoft, about the Microsoft new security pillars:  Monitoring, Threat Protection and Information Protection. Timing:  0:00 - Introducing our guest 5:45  - Introducing Microsoft security strategy 12:50 - Security monitoring pillars - Azure monitor, Sentinel, Azure analytics and more 21:10 - Microsoft Threat Protection family - Cloudapp, O365 ATP, Defender ATP, Azure ATP 30:50 - diving deeper into Cloudapp 35:30 - Microsoft Information Protection  44:00 - summary and last words ...

Listen

Episode 7

September 02, 2019 00:36:26
Episode Cover

Episode 7: Creating Trust in Cloud

Attendees Guest: Damir Savanović Guest title: Senior researcher Company: Cloud Security Alliance Abstract Creating trust is one of the major challenges for cloud providers and consumers, without trust customers will not be able to move workloads into cloud environments, but trust is a very elusive term that is hard to achieve. In  this episode we talk with Damir Savanović from the Cloud Security Alliance on how cloud providers and consumers can use certifications for increasing trust and how is CSA preparing to the new requirements of continuous monitoring that are arriving with the new EU cyber laws. Timing 0:00 Intro and introducing our guest and overview of Damir activities in the area of cloud security 5:40 Introducing Cloud Security Alliance activities and major projects (STAR and CCSK) 9.17  The true meaning of trust in cloud computing. Using attestation and certification for establishing trust 14:50   The difference between certification and attestation and the effect of the new EU cybersecurity law on compliance 17.50 Understanding CSA STAR methodology from self assessment to certification or attestation and continuous monitoring 24.20 Behind the scenes of continuous monitoring - the CSA STAR methodology  32.00 Summary and conclusions ...

Listen