Additional References

This section contains links for additional reading that are relevant to the training

General

• AWS Cloud Adoption Framework Security

• AWS Security Best Practices

• Getting started with Azure Security

• Building a cloud specific incident response plan for AWS

• How I learned to stop worrying and love the cloud (Azure forensics)

• Guidelines for Evidence Collection and Archiving

• CSA CCSK Certification

• Download CSA Cloud Controls Matrix from here

• See this web page for Security Path

• Guidelines on Security and Privacy in Public Cloud Computing

• Cloud computing NIST Security Reference Architecture

• OWASP Cloud Security Project

• AWS exploitation framework

• AWS privilege escalation methods implemented in Pacu

• Using Burp to brute force a login page

• Using hydra to brute force a HTML form

• Cloud Security Suite

• 7 common pitfalls when moving to the cloud

• Subdomain takeover on Starbucks

• Accenture S3 data leak

AWS

• AWS in Plain English

• Amazon Web Services - a practical guide

• AWS CIS Benchmarks

• AWS Security Best Practices

• AWS Security Primer

• Security auditing tool for AWS environments

• Prowler: AWS CIS Benchmark Tool

• Nimbostratus -Tools for fingerprinting and exploiting AWS

• Aardvark is a multi-account AWS IAM Access Advisor API

• Security Monkey

• CloudSploit Scans

• System Shock: How A Cloud Leak Exposed Accenture's Business

• Fullstop - Audit reporting

• Getting shell and data access in AWS by chaining vulnerabilities

• Getting started with Version 2 of AWS EC2 Instance Metadata service (IMDSv2)

• Server Side Request Forgery (SSRF) and AWS EC2 instances after Instance Meta Data Service version 2(IMDSv2)

• An SSRF, privileged AWS keys and the Capital One breach

• Server Side Request Forgery via HTML injection in PDF download

• Abusing the AWS metadata service using SSRF vulnerabilities

• AWS Vulnerabilities and the Attacker's Perspective

• Pivoting in Amazon Clouds

• Security Tools for AWS

• https://github.com/nccgroup/PMapper

• https://github.com/nccgroup/aws-inventory

• https://yashvier.app.box.com/v/boostawssecurity

• AWS changes its PenTesting permission requirement, Appsecco found out exactly what is allowed and what is not

Azure

• Microsoft Azure in Plain English

• Azure Security Centre

• Azure security technical capabilities

• Security auditing tool for Azure environments

• Azure Security Lab Workshop

• Enumeration and reconnaissance activities in the Microsoft Azure Cloud

• Azure Security and Compliance Blueprint - FedRAMP Web Applications Automation

• Secure DevOps Kit for Azure (AzSK)

• Logging in Azure

Serverless

• Servleress Framework Documentation

• AWS SDK for Javascript

• Azure SDK for Node.js

• GCP Javascript API Documentaion

• Intrusion and Exfiltration in Server-less Architectures

• Serverless Architecture

• Serverless Technologies

• Awesome Serverless

• Security related books from Appsecco

• Appsecco blog