SlideShare a Scribd company logo
1 of 36
From 0 to Secure in 1 Minute
DEFCON 23
Nir Valtman & Moshe Ferber
About Us
Nir Valtman Moshe Ferber
 CISO Retail in NCR Corporation.
 We own a private cloud & offering SaaS
 Yes… we do security!
 Instructor for Cloud Security (CCSK) –
that’s what I really like doing
Passionate about information security
Involved in numerous startups and initiatives – sometimes with success, sometimes not…
Industry speakers and lecturers – that’s why we are here
I like non-
sweating
sports!
I don’t like
sport!
About the talk
Cloud security challenges and benefits
And more specifically, using IaaS automation and orchestration features for increasing the security
Dashboard Billing API
Orchestration
Hypervisor Controller Abstraction
Physical
Servers
Network Storage
About the talk
Cloud
Attack
Vectors
Provider
administration
Management
console
Multi tenancy
&
virtualization
Automation
& API
Chain of
supply
Side channel
attack
Insecure
instances
Anatomy of a cloud hack
Anatomy of a cloud hack – the BrowserStack story
Shell shock
vulnerability
on unused
server
Found API
key on
hacked
server
Using API
key opened
a firewall
rule and
launch an
instance
Attached a
backup
volume to
the instance
Found
database
credential
on backup
device
Connected
to DB
SOURCE: https://www.browserstack.com/attack-and-downtime-on-9-November
Do we have the right tools?
Source: http://ifail.info/wp-content/uploads/2010/04/street_dentist_thumb.jpg?98bbf9
About the talk
Micro-Services Architecture
DEV OPS
Continuous
Delivery
1 hour
10 min
1 min
Architecture &
Deployments is changing
The billing cycle is
reducing
Google slashes
cloud platform
price again
Microsoft will offer
Azure by the minute to
take on Amazon’s cloud
Microsoft follows Google
with by-the-minute cloud
blending
AUTO SCALING
About the talkHow to do security when servers alive for 10 minutes?
Patch management
Maintenance
windows
Periodic vulnerability
scanning
Hardening
DON’T LET SECURITY HOLD YOU DOWN
Source: www.avon-barrier.co.uk
About the talk
Introducing
SOURCE: http://www.cloudefigo.org/
Based on the work made by Rich Mogull from Securosis
https://github.com/securosis
Cloudefigo Lifecycle
Server launch1
Server loads
security
configuration
Server encrypts
disk volumes
Server scanned for
vulnerabilities
Server moves to
production
S3
2
3
4
5
Components
Object
Storage
Vulnerability
Scanner
Cloud-Init
Configuration
Management
IAM Roles
Volume
Encryption
Instant Lifecycle
Launch
Update
Control
Scan
Production
Terminate
LAUNCH
Prepare
Cloudinit
 Each machine manage its own attributes
 Encryption keys
 Remediation vs production groups
 Management of these attributes require permissions
 Permissions during launch > production
 Thus, a dynamic IAM role is required
LAUNCH
Prepare
Cloudinit
LAUNCH
Prepare
Cloudinit
 Executed in root permissions when image is
launching.
 Responsible for building the infrastructure for the
following steps.
LAUNCH
Prepare
Cloudinit
UPDATE
OS update
Pre-requisites
 CloudInit to update & upgrade software packages
 Primary goal is to make sure the cloud instance is
secure once upgraded
UPDATE
OS update
Pre-requisites
 CloudInit to install the software packages required
to operate:
 Python + pip + wheel
 AWS SDK (Boto)
 Chef Client + Chef SDK (PyChef)
 Download configurations and scripts from S3:
 Cloudefigo script
 Chef client initialization files
 Cloudinit to create and attach a volume for
application files and data.
CONTROL
Chef
Registration
Encrypt
 The Chef clients register to the Chef Management
server using the initialization files loaded from S3.
 Once the client is registered, a policy is loaded and
enforced on the instance.
CONTROL
Chef
Registration
Encrypt
Where should you keep your keys?
Cloud Provider On Premise 3rd Party
Protected Snapshots and
backups
Snapshots, backups,
subpoena and
malicious insiders
Snapshots, backups
and cloud provider’s
malicious insiders
Vulnerable Malicious insider
attacks and
subpoena
Key exchange attacks Key exchange attacks
and subpoena
(partial)
CONTROL
Chef
Registration
Encrypt
 The volume to be encrypted using randomly
generated key.
 The key is stored on S3 for later use.
 The application database to be installed in the
encrypted volume.
Instance 1
Instance 2
Instance 3
Bucket 2f3g
Bucket 5dw4
Bucket 8H7g
Key ID 5dw4
Key ID 8H7g
Key ID 2f3g
Key 1#Fd3
Key vFS3=
Key Bs$a
CONTROL
Chef
Registration
Encrypt
 Dynamic S3 policy: access to key require a
referrer header that is generated based on
attributes from the instance.
CONTROL
Chef
Registration
Encrypt
SCAN
Automatic
Scan
Analyze
 A vulnerability scan to be launched automatically
by CloudInit script.
 The deeper the scan, the longer it takes to move
to production.
SCAN
Automatic
Scan
Analyze
 The results of the scan are analyzed by the
Cloudefigo script.
 Based on scan results – the instance to move to
production or remain in the remediation group.
 The lowest security risk severity can be defined.
SCAN
Automatic
Scan
Analyze
PRODUCTION
Least privileged
role
Manage
 Reminder: Permissions in launch > production
 IAM role permissions reduced dynamically -
contains read only access
PRODUCTION
Least privileged
role
Manage
 For the ongoing operations – a compensating
controls are required.
 Cloudefigo management script lists cloud
instances and validates they are managed by Chef
 Cloudefigo will set alert when someone will try to
use access keys.
PRODUCTION
Least privileged
role
Manage
Setting a CloudWatch alarm
PRODUCTION
Least privileged
role
Manage
TERMINATE
Instance
Encryption
Keys
 The life cycle ends once a server is terminated
along with:
 Attached volumes
 IAM role
TERMINATE
Instance
Encryption
Keys
 The instance data still exist in backups/snapshots
or provider storage
 Encryption keys to be deleted with instance in
order to make sure the backup data remain
inaccessible (not implemented in this version)
Wrapping Up
The new software architecture and applications delivery in cloud
module disrupts traditional correctives controls
We need to adopt new thinking to
automate security
Think how security automation can help you in moving your
infrastructure forward. Faster.
Questions
Moshe Ferber
@: moshe (at) onlinecloudsec.com
w: www.onlinecloudsec.com
in: www.linkedin.com/in/MosheFerber
t: @FerberMoshe
Nir Valtman
@: nir.valtman (at) ncr.com
w: www.ncr.com | www.valtman.org
in: www.linkedin.com/in/valtmanir
t: @ValtmaNir
www.cloudefigo.org

More Related Content

What's hot

Cloud security what to expect (introduction to cloud security)
Cloud security   what to expect (introduction to cloud security)Cloud security   what to expect (introduction to cloud security)
Cloud security what to expect (introduction to cloud security)Moshe Ferber
 
The Notorious 9 Cloud Computing Threats - CSA Congress, San Jose
The Notorious 9 Cloud Computing Threats -  CSA Congress, San JoseThe Notorious 9 Cloud Computing Threats -  CSA Congress, San Jose
The Notorious 9 Cloud Computing Threats - CSA Congress, San JoseMoshe Ferber
 
Cloud risk and business continuity v21
Cloud risk and business continuity v21Cloud risk and business continuity v21
Cloud risk and business continuity v21Jorge Sebastiao
 
Cloud Computing Security - Cloud Controls Security
Cloud Computing Security - Cloud Controls SecurityCloud Computing Security - Cloud Controls Security
Cloud Computing Security - Cloud Controls SecurityHari Kumar
 
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...Amazon Web Services
 
Cloud Access Security Brokers - CASB
Cloud Access Security Brokers - CASB Cloud Access Security Brokers - CASB
Cloud Access Security Brokers - CASB Samrat Das
 
Cloud keybank privacy and owner authorization
Cloud keybank  privacy and owner authorizationCloud keybank  privacy and owner authorization
Cloud keybank privacy and owner authorizationPvrtechnologies Nellore
 
Secaa s cat_10_network_security_implementation_guidance
Secaa s cat_10_network_security_implementation_guidanceSecaa s cat_10_network_security_implementation_guidance
Secaa s cat_10_network_security_implementation_guidancedrewz lin
 
Cloud security, Cloud security Access broker, CSAB's 4 pillar, deployment mode
Cloud security, Cloud security Access broker, CSAB's 4 pillar, deployment modeCloud security, Cloud security Access broker, CSAB's 4 pillar, deployment mode
Cloud security, Cloud security Access broker, CSAB's 4 pillar, deployment modeHimani Singh
 
2012 10 cloud security architecture
2012 10 cloud security architecture2012 10 cloud security architecture
2012 10 cloud security architectureVladimir Jirasek
 
CSA SV Threat detection and prediction
CSA SV Threat detection and predictionCSA SV Threat detection and prediction
CSA SV Threat detection and predictionVishwas Manral
 
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...Amazon Web Services
 
Cloud Security - Kloudlearn
Cloud Security - KloudlearnCloud Security - Kloudlearn
Cloud Security - KloudlearnKloudLearn
 

What's hot (19)

Cloud security what to expect (introduction to cloud security)
Cloud security   what to expect (introduction to cloud security)Cloud security   what to expect (introduction to cloud security)
Cloud security what to expect (introduction to cloud security)
 
The Notorious 9 Cloud Computing Threats - CSA Congress, San Jose
The Notorious 9 Cloud Computing Threats -  CSA Congress, San JoseThe Notorious 9 Cloud Computing Threats -  CSA Congress, San Jose
The Notorious 9 Cloud Computing Threats - CSA Congress, San Jose
 
Cloud risk and business continuity v21
Cloud risk and business continuity v21Cloud risk and business continuity v21
Cloud risk and business continuity v21
 
Cloud Security Governance
Cloud Security GovernanceCloud Security Governance
Cloud Security Governance
 
null Bangalore meet - Cloud Computing and Security
null Bangalore meet - Cloud Computing and Securitynull Bangalore meet - Cloud Computing and Security
null Bangalore meet - Cloud Computing and Security
 
Cloud Computing Security - Cloud Controls Security
Cloud Computing Security - Cloud Controls SecurityCloud Computing Security - Cloud Controls Security
Cloud Computing Security - Cloud Controls Security
 
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
AWS Security Best Practices in a Zero Trust Security Model - DEM08 - Toronto ...
 
Security As A Service In Cloud(SECaaS)
Security As A Service In Cloud(SECaaS)Security As A Service In Cloud(SECaaS)
Security As A Service In Cloud(SECaaS)
 
cloud security ppt
cloud security ppt cloud security ppt
cloud security ppt
 
Cloud Security & Cloud Encryption Explained
Cloud Security & Cloud Encryption ExplainedCloud Security & Cloud Encryption Explained
Cloud Security & Cloud Encryption Explained
 
Cloud Access Security Brokers - CASB
Cloud Access Security Brokers - CASB Cloud Access Security Brokers - CASB
Cloud Access Security Brokers - CASB
 
Cloud keybank privacy and owner authorization
Cloud keybank  privacy and owner authorizationCloud keybank  privacy and owner authorization
Cloud keybank privacy and owner authorization
 
Secaa s cat_10_network_security_implementation_guidance
Secaa s cat_10_network_security_implementation_guidanceSecaa s cat_10_network_security_implementation_guidance
Secaa s cat_10_network_security_implementation_guidance
 
Cloud security, Cloud security Access broker, CSAB's 4 pillar, deployment mode
Cloud security, Cloud security Access broker, CSAB's 4 pillar, deployment modeCloud security, Cloud security Access broker, CSAB's 4 pillar, deployment mode
Cloud security, Cloud security Access broker, CSAB's 4 pillar, deployment mode
 
2012 10 cloud security architecture
2012 10 cloud security architecture2012 10 cloud security architecture
2012 10 cloud security architecture
 
Cloud security
Cloud securityCloud security
Cloud security
 
CSA SV Threat detection and prediction
CSA SV Threat detection and predictionCSA SV Threat detection and prediction
CSA SV Threat detection and prediction
 
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
 
Cloud Security - Kloudlearn
Cloud Security - KloudlearnCloud Security - Kloudlearn
Cloud Security - Kloudlearn
 

Viewers also liked

Nouvelle experience audiovisuelle
Nouvelle experience audiovisuelleNouvelle experience audiovisuelle
Nouvelle experience audiovisuelleMarc Bourhis
 
Certificate bypass: Hiding and executing malware from a digitally signed exec...
Certificate bypass: Hiding and executing malware from a digitally signed exec...Certificate bypass: Hiding and executing malware from a digitally signed exec...
Certificate bypass: Hiding and executing malware from a digitally signed exec...Priyanka Aash
 
Cheat sheet - Plan of Care
Cheat sheet - Plan of CareCheat sheet - Plan of Care
Cheat sheet - Plan of CareJack Frost
 
L 4 sims prep student 2016
L 4 sims prep student 2016L 4 sims prep student 2016
L 4 sims prep student 2016Jack Frost
 
Experiences building apps with React Native @UtrechtJS May 2016
Experiences building apps with React Native @UtrechtJS May 2016Experiences building apps with React Native @UtrechtJS May 2016
Experiences building apps with React Native @UtrechtJS May 2016Adrian Philipp
 
Harfoot portfolio
Harfoot portfolioHarfoot portfolio
Harfoot portfoliobharfoot
 
Joyce Rowlands Résumé 2016
Joyce Rowlands Résumé 2016Joyce Rowlands Résumé 2016
Joyce Rowlands Résumé 2016Joyce Rowlands
 
Tequila ou Tortilha? Notas sobre a Economia Brasileira nos Noventa
Tequila ou Tortilha? Notas sobre a Economia Brasileira nos NoventaTequila ou Tortilha? Notas sobre a Economia Brasileira nos Noventa
Tequila ou Tortilha? Notas sobre a Economia Brasileira nos NoventaGrupo de Economia Política IE-UFRJ
 
Development and use of an ePortfolio platform to stimulate medical student re...
Development and use of an ePortfolio platform to stimulate medical student re...Development and use of an ePortfolio platform to stimulate medical student re...
Development and use of an ePortfolio platform to stimulate medical student re...ePortfolios Australia
 
Emakina Digital Reality
Emakina Digital RealityEmakina Digital Reality
Emakina Digital RealityEmakina
 
ConférenSquad #2 : Expway - LTE Broadcast
ConférenSquad #2 : Expway - LTE BroadcastConférenSquad #2 : Expway - LTE Broadcast
ConférenSquad #2 : Expway - LTE BroadcastJustindwah
 
Tutoriel sur le streaming vidéo sur HTTP et sur MPEG-DASH
Tutoriel sur le streaming vidéo sur HTTP et sur MPEG-DASHTutoriel sur le streaming vidéo sur HTTP et sur MPEG-DASH
Tutoriel sur le streaming vidéo sur HTTP et sur MPEG-DASHCyril Concolato
 
Le mobile, notre principal écran média
Le mobile, notre principal écran médiaLe mobile, notre principal écran média
Le mobile, notre principal écran médiaEmakina
 

Viewers also liked (15)

Nouvelle experience audiovisuelle
Nouvelle experience audiovisuelleNouvelle experience audiovisuelle
Nouvelle experience audiovisuelle
 
Certificate bypass: Hiding and executing malware from a digitally signed exec...
Certificate bypass: Hiding and executing malware from a digitally signed exec...Certificate bypass: Hiding and executing malware from a digitally signed exec...
Certificate bypass: Hiding and executing malware from a digitally signed exec...
 
Cheat sheet - Plan of Care
Cheat sheet - Plan of CareCheat sheet - Plan of Care
Cheat sheet - Plan of Care
 
L 4 sims prep student 2016
L 4 sims prep student 2016L 4 sims prep student 2016
L 4 sims prep student 2016
 
Experiences building apps with React Native @UtrechtJS May 2016
Experiences building apps with React Native @UtrechtJS May 2016Experiences building apps with React Native @UtrechtJS May 2016
Experiences building apps with React Native @UtrechtJS May 2016
 
Harfoot portfolio
Harfoot portfolioHarfoot portfolio
Harfoot portfolio
 
Joyce Rowlands Résumé 2016
Joyce Rowlands Résumé 2016Joyce Rowlands Résumé 2016
Joyce Rowlands Résumé 2016
 
Tequila ou Tortilha? Notas sobre a Economia Brasileira nos Noventa
Tequila ou Tortilha? Notas sobre a Economia Brasileira nos NoventaTequila ou Tortilha? Notas sobre a Economia Brasileira nos Noventa
Tequila ou Tortilha? Notas sobre a Economia Brasileira nos Noventa
 
Development and use of an ePortfolio platform to stimulate medical student re...
Development and use of an ePortfolio platform to stimulate medical student re...Development and use of an ePortfolio platform to stimulate medical student re...
Development and use of an ePortfolio platform to stimulate medical student re...
 
Emakina Digital Reality
Emakina Digital RealityEmakina Digital Reality
Emakina Digital Reality
 
Choque de produtividade
Choque de produtividadeChoque de produtividade
Choque de produtividade
 
Cs ppt1
Cs ppt1Cs ppt1
Cs ppt1
 
ConférenSquad #2 : Expway - LTE Broadcast
ConférenSquad #2 : Expway - LTE BroadcastConférenSquad #2 : Expway - LTE Broadcast
ConférenSquad #2 : Expway - LTE Broadcast
 
Tutoriel sur le streaming vidéo sur HTTP et sur MPEG-DASH
Tutoriel sur le streaming vidéo sur HTTP et sur MPEG-DASHTutoriel sur le streaming vidéo sur HTTP et sur MPEG-DASH
Tutoriel sur le streaming vidéo sur HTTP et sur MPEG-DASH
 
Le mobile, notre principal écran média
Le mobile, notre principal écran médiaLe mobile, notre principal écran média
Le mobile, notre principal écran média
 

Similar to Defcon23 from zero to secure in 1 minute - nir valtman and moshe ferber

From 0 to Secure in 1 Minute - Securing laaS - Nir Valtman
From 0 to Secure in 1 Minute - Securing laaS - Nir ValtmanFrom 0 to Secure in 1 Minute - Securing laaS - Nir Valtman
From 0 to Secure in 1 Minute - Securing laaS - Nir ValtmanEC-Council
 
DEFCON 23 - Nir Valtman and Moshe Ferber - from zero to secure in 1
DEFCON 23 - Nir Valtman and  Moshe Ferber - from zero to secure in 1DEFCON 23 - Nir Valtman and  Moshe Ferber - from zero to secure in 1
DEFCON 23 - Nir Valtman and Moshe Ferber - from zero to secure in 1Felipe Prado
 
Cloudefigo - From zero to secure in 1 minute
Cloudefigo - From zero to secure in 1 minuteCloudefigo - From zero to secure in 1 minute
Cloudefigo - From zero to secure in 1 minuteIsrael AWS User Group
 
Using Security to Build with Confidence in AWS - Trend Micro
Using Security to Build with Confidence in AWS - Trend Micro Using Security to Build with Confidence in AWS - Trend Micro
Using Security to Build with Confidence in AWS - Trend Micro Amazon Web Services
 
DIY-CyberArk-Blueprint-Roadmap-Template.pptx
DIY-CyberArk-Blueprint-Roadmap-Template.pptxDIY-CyberArk-Blueprint-Roadmap-Template.pptx
DIY-CyberArk-Blueprint-Roadmap-Template.pptxBirLama2
 
Cloud Application Security: Lessons Learned
Cloud Application Security: Lessons LearnedCloud Application Security: Lessons Learned
Cloud Application Security: Lessons LearnedJason Chan
 
Tips to Remediate your Vulnerability Management Program
Tips to Remediate your Vulnerability Management ProgramTips to Remediate your Vulnerability Management Program
Tips to Remediate your Vulnerability Management ProgramBeyondTrust
 
Advanced Security Automation Made Simple
Advanced Security Automation Made SimpleAdvanced Security Automation Made Simple
Advanced Security Automation Made SimpleMark Nunnikhoven
 
Duck Hunter - The return of autorun
Duck Hunter - The return of autorunDuck Hunter - The return of autorun
Duck Hunter - The return of autorunNimrod Levy
 
Nimrod duck hunter copy
Nimrod duck hunter   copyNimrod duck hunter   copy
Nimrod duck hunter copyNimrod Levy
 
Cloud Application Security: Lessons Learned
Cloud Application Security: Lessons LearnedCloud Application Security: Lessons Learned
Cloud Application Security: Lessons LearnedJason Chan
 
Integrating_Cloud_Development_Security_And_Operations.pdf
Integrating_Cloud_Development_Security_And_Operations.pdfIntegrating_Cloud_Development_Security_And_Operations.pdf
Integrating_Cloud_Development_Security_And_Operations.pdfAmazon Web Services
 
Putting it All Together: Securing Systems at Cloud Scale
Putting it All Together: Securing Systems at Cloud ScalePutting it All Together: Securing Systems at Cloud Scale
Putting it All Together: Securing Systems at Cloud ScaleAmazon Web Services
 
Automate the Provisioning of Secure Developer Environments on AWS PPT
 Automate the Provisioning of Secure Developer Environments on AWS PPT Automate the Provisioning of Secure Developer Environments on AWS PPT
Automate the Provisioning of Secure Developer Environments on AWS PPTAmazon Web Services
 
Security and Advanced Automation in the Enterprise
Security and Advanced Automation in the EnterpriseSecurity and Advanced Automation in the Enterprise
Security and Advanced Automation in the EnterpriseAmazon Web Services
 
Security automation simplified: an intro to DIY security automation
Security automation simplified: an intro to DIY security automationSecurity automation simplified: an intro to DIY security automation
Security automation simplified: an intro to DIY security automationMoses Schwartz
 
AWS Summit Singapore - Next Generation Security
AWS Summit Singapore - Next Generation SecurityAWS Summit Singapore - Next Generation Security
AWS Summit Singapore - Next Generation SecurityAmazon Web Services
 
Virutalization and the Future of Datacenter Security
Virutalization and the Future of Datacenter SecurityVirutalization and the Future of Datacenter Security
Virutalization and the Future of Datacenter Securityguestb09e16
 
Secure Configuration and Automation Overview
Secure Configuration and Automation OverviewSecure Configuration and Automation Overview
Secure Configuration and Automation OverviewAmazon Web Services
 

Similar to Defcon23 from zero to secure in 1 minute - nir valtman and moshe ferber (20)

From 0 to Secure in 1 Minute - Securing laaS - Nir Valtman
From 0 to Secure in 1 Minute - Securing laaS - Nir ValtmanFrom 0 to Secure in 1 Minute - Securing laaS - Nir Valtman
From 0 to Secure in 1 Minute - Securing laaS - Nir Valtman
 
DEFCON 23 - Nir Valtman and Moshe Ferber - from zero to secure in 1
DEFCON 23 - Nir Valtman and  Moshe Ferber - from zero to secure in 1DEFCON 23 - Nir Valtman and  Moshe Ferber - from zero to secure in 1
DEFCON 23 - Nir Valtman and Moshe Ferber - from zero to secure in 1
 
Cloudefigo - From zero to secure in 1 minute
Cloudefigo - From zero to secure in 1 minuteCloudefigo - From zero to secure in 1 minute
Cloudefigo - From zero to secure in 1 minute
 
Using Security to Build with Confidence in AWS - Trend Micro
Using Security to Build with Confidence in AWS - Trend Micro Using Security to Build with Confidence in AWS - Trend Micro
Using Security to Build with Confidence in AWS - Trend Micro
 
DIY-CyberArk-Blueprint-Roadmap-Template.pptx
DIY-CyberArk-Blueprint-Roadmap-Template.pptxDIY-CyberArk-Blueprint-Roadmap-Template.pptx
DIY-CyberArk-Blueprint-Roadmap-Template.pptx
 
Cloud Application Security: Lessons Learned
Cloud Application Security: Lessons LearnedCloud Application Security: Lessons Learned
Cloud Application Security: Lessons Learned
 
Tips to Remediate your Vulnerability Management Program
Tips to Remediate your Vulnerability Management ProgramTips to Remediate your Vulnerability Management Program
Tips to Remediate your Vulnerability Management Program
 
Advanced Security Automation Made Simple
Advanced Security Automation Made SimpleAdvanced Security Automation Made Simple
Advanced Security Automation Made Simple
 
Duck Hunter - The return of autorun
Duck Hunter - The return of autorunDuck Hunter - The return of autorun
Duck Hunter - The return of autorun
 
Nimrod duck hunter copy
Nimrod duck hunter   copyNimrod duck hunter   copy
Nimrod duck hunter copy
 
Cloud Application Security: Lessons Learned
Cloud Application Security: Lessons LearnedCloud Application Security: Lessons Learned
Cloud Application Security: Lessons Learned
 
Integrating_Cloud_Development_Security_And_Operations.pdf
Integrating_Cloud_Development_Security_And_Operations.pdfIntegrating_Cloud_Development_Security_And_Operations.pdf
Integrating_Cloud_Development_Security_And_Operations.pdf
 
Putting it All Together: Securing Systems at Cloud Scale
Putting it All Together: Securing Systems at Cloud ScalePutting it All Together: Securing Systems at Cloud Scale
Putting it All Together: Securing Systems at Cloud Scale
 
Automate the Provisioning of Secure Developer Environments on AWS PPT
 Automate the Provisioning of Secure Developer Environments on AWS PPT Automate the Provisioning of Secure Developer Environments on AWS PPT
Automate the Provisioning of Secure Developer Environments on AWS PPT
 
Security and Advanced Automation in the Enterprise
Security and Advanced Automation in the EnterpriseSecurity and Advanced Automation in the Enterprise
Security and Advanced Automation in the Enterprise
 
Security automation simplified: an intro to DIY security automation
Security automation simplified: an intro to DIY security automationSecurity automation simplified: an intro to DIY security automation
Security automation simplified: an intro to DIY security automation
 
AWS Summit Singapore - Next Generation Security
AWS Summit Singapore - Next Generation SecurityAWS Summit Singapore - Next Generation Security
AWS Summit Singapore - Next Generation Security
 
Cloud Security Fundamentals Webinar
Cloud Security Fundamentals WebinarCloud Security Fundamentals Webinar
Cloud Security Fundamentals Webinar
 
Virutalization and the Future of Datacenter Security
Virutalization and the Future of Datacenter SecurityVirutalization and the Future of Datacenter Security
Virutalization and the Future of Datacenter Security
 
Secure Configuration and Automation Overview
Secure Configuration and Automation OverviewSecure Configuration and Automation Overview
Secure Configuration and Automation Overview
 

More from Moshe Ferber

Cloud Security - the egregious 11 cloud security threats
Cloud Security - the egregious 11  cloud security threatsCloud Security - the egregious 11  cloud security threats
Cloud Security - the egregious 11 cloud security threatsMoshe Ferber
 
Understanding IaaS/PaaS attack vectors.pptx
Understanding IaaS/PaaS attack vectors.pptxUnderstanding IaaS/PaaS attack vectors.pptx
Understanding IaaS/PaaS attack vectors.pptxMoshe Ferber
 
Foundations of cloud security monitoring
Foundations of cloud security monitoringFoundations of cloud security monitoring
Foundations of cloud security monitoringMoshe Ferber
 
Cloud security certifications landscape
Cloud security certifications landscapeCloud security certifications landscape
Cloud security certifications landscapeMoshe Ferber
 
Cloud Security Architecture.pptx
Cloud Security Architecture.pptxCloud Security Architecture.pptx
Cloud Security Architecture.pptxMoshe Ferber
 
Cloud security for financial services
Cloud security for financial servicesCloud security for financial services
Cloud security for financial servicesMoshe Ferber
 

More from Moshe Ferber (6)

Cloud Security - the egregious 11 cloud security threats
Cloud Security - the egregious 11  cloud security threatsCloud Security - the egregious 11  cloud security threats
Cloud Security - the egregious 11 cloud security threats
 
Understanding IaaS/PaaS attack vectors.pptx
Understanding IaaS/PaaS attack vectors.pptxUnderstanding IaaS/PaaS attack vectors.pptx
Understanding IaaS/PaaS attack vectors.pptx
 
Foundations of cloud security monitoring
Foundations of cloud security monitoringFoundations of cloud security monitoring
Foundations of cloud security monitoring
 
Cloud security certifications landscape
Cloud security certifications landscapeCloud security certifications landscape
Cloud security certifications landscape
 
Cloud Security Architecture.pptx
Cloud Security Architecture.pptxCloud Security Architecture.pptx
Cloud Security Architecture.pptx
 
Cloud security for financial services
Cloud security for financial servicesCloud security for financial services
Cloud security for financial services
 

Recently uploaded

New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
Sample pptx for embedding into website for demo
Sample pptx for embedding into website for demoSample pptx for embedding into website for demo
Sample pptx for embedding into website for demoHarshalMandlekar2
 
Visualising and forecasting stocks using Dash
Visualising and forecasting stocks using DashVisualising and forecasting stocks using Dash
Visualising and forecasting stocks using Dashnarutouzumaki53779
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteDianaGray10
 
Fact vs. Fiction: Autodetecting Hallucinations in LLMs
Fact vs. Fiction: Autodetecting Hallucinations in LLMsFact vs. Fiction: Autodetecting Hallucinations in LLMs
Fact vs. Fiction: Autodetecting Hallucinations in LLMsZilliz
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxLoriGlavin3
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfMounikaPolabathina
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Strongerpanagenda
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3
 
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DayH2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DaySri Ambati
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxLoriGlavin3
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Manik S Magar
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxLoriGlavin3
 
Exploring ChatGPT Prompt Hacks To Maximally Optimise Your Queries
Exploring ChatGPT Prompt Hacks To Maximally Optimise Your QueriesExploring ChatGPT Prompt Hacks To Maximally Optimise Your Queries
Exploring ChatGPT Prompt Hacks To Maximally Optimise Your QueriesSanjay Willie
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality AssuranceInflectra
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 

Recently uploaded (20)

New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
Sample pptx for embedding into website for demo
Sample pptx for embedding into website for demoSample pptx for embedding into website for demo
Sample pptx for embedding into website for demo
 
Visualising and forecasting stocks using Dash
Visualising and forecasting stocks using DashVisualising and forecasting stocks using Dash
Visualising and forecasting stocks using Dash
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test Suite
 
Fact vs. Fiction: Autodetecting Hallucinations in LLMs
Fact vs. Fiction: Autodetecting Hallucinations in LLMsFact vs. Fiction: Autodetecting Hallucinations in LLMs
Fact vs. Fiction: Autodetecting Hallucinations in LLMs
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdf
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache Maven
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
 
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DayH2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptx
 
Exploring ChatGPT Prompt Hacks To Maximally Optimise Your Queries
Exploring ChatGPT Prompt Hacks To Maximally Optimise Your QueriesExploring ChatGPT Prompt Hacks To Maximally Optimise Your Queries
Exploring ChatGPT Prompt Hacks To Maximally Optimise Your Queries
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 

Defcon23 from zero to secure in 1 minute - nir valtman and moshe ferber