Bishop Fox named “Leader” in 2024 GigaOm Radar for Attack Surface Management. Read the Report ›

Cloud Security Podcast: Cloud Pen Test of AWS with Open Source

Hear from Bishop Fox's Seth Art in Episode 161 of Cloud Security Podcast as he shares his extensive experience with cloud penetration testing.

Hear from Bishop Fox's Seth Art in Episode 161 of Cloud Security Podcast as he talks about his extensive experience with cloud penetration testing. If your organization is thinking about getting a pen test done on your AWS account or you want to learn how to pen test in AWS, you don’t want to miss this conversation with Ashish Rajan, Cloud Security Podcast host, and Seth Art.

Discussion with Seth Art:

  • 00:00 Introduction
  • 04:24 A bit about Seth
  • 06:10 Web App Pentesting vs Cloud Pentesting
  • 08:11 Working with scale of multiple AWS accounts
  • 10:20 What can you expect to find with Cloud Pentesting?
  • 12:14 Foundational pieces about approaching pentesting in Cloud
  • 15:19 How to start a Cloud Pentest?
  • 18:25 The importance of IAM
  • 23:43 Common services in AWS to look at
  • 25:58 Mistakes people make for scoping
  • 29:18 The role of shared responsibility in Cloud Pentesting
  • 32:38 Boundaries for AWS pentesting
  • 35:13 Nmapping between 2 EC2 instances
  • 36:37 How do you explain the findings?
  • 40:26 Skillsets required to transition to Cloud Pentesting
  • 45:41 Transitioning from Kubernetes to Cloud Pentesting
  • 48:55 Resources for learning about Cloud Pentesting.
  • 49:47 The Fun Section

Seth art

About the author, Seth Art

Principal Security Consultant

Seth Art (OSCP) is a Principal Security Consultant at Bishop Fox, where he currently focuses on penetration testing cloud environments, Kubernetes clusters, and traditional internal networks.

Seth is the author of multiple open-source projects including CloudFox, CloudFoxable, IAM Vulnerable, Bad Pods, celeryStalk, and PyCodeInjection. He has presented at security conferences, including fwd:cloudsec, DerbyCon, and BSidesDC, published multiple CVEs, and is the founder of IthacaSec, a security meetup in upstate NY.

More by Seth

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.