Red Teaming AWS: Practice What You Preach
summary
A cloud consultancy red teams its AWS account, spins a VM and sends a phishing email to measure realism and learning. Detection metrics are concrete: 12 minutes to identify and 1h28 to contain with about two thirds of intrusions found. Tests reveal misconfigurations like KMS misconfig open to any principal and exposed secrets such as GitHub creds in Parameter Store. Built followups include backlog Jira tickets, internal CTFs and shared tooling; remediation and cultural change follow.
AI-written summary · about
chapters (8)
- 0:00Red teaming AWS
- 3:06Self-red team exercise
- 8:38Red team blue team setup
- 12:30Exercise begins
- 18:29Breach escalation and containment
- 22:38Performance and outcomes
- 25:26OODA loop lessons
- 27:32Legacy from exercise
related talks
35mRed Teaming AWS: Practice What You Preach/
24mPurple Teaming Like Sky’s the Limit – Adversary Emulation in the Cloud...
13mA guide to strengthening your threat detection and response
32mHow to Train your Red Team (for Cloud Native)
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
32mThreat-Driven Development
46mAttacking AWS: The Full Cyber Kill Chain
42mRed vs. Bank: Surviving a Three Year Red Team