Red Teaming AWS: Practice What You Preach/
summary
A consultancy conducts a surprise red team assault on its AWS account, kills senior IAM access, launches an EC2 alarm and a phishing email, and routes actions through junior engineers while a double agent reports progress. Measurements are concrete: time to identify 12 minutes, time to contain 1h28m, 66% intrusion detected. Outcomes include revoked credentials, discovered exposed GitHub secrets, a forced rebuild of incident playbooks, security backlog work itemized in Jira, and recurring CTFs and remediation that stick.
AI-written summary · about
chapters (12)
- 0:00Start
- 3:03The Three Kinds of Knowledge That Exists
- 5:12Defined Incident Response Process
- 7:35How Do You Measure Performance in a Red Team Activity
- 8:34Key Performance Metrics
- 10:31Who Will Take Responsibility
- 12:04What Lenses Do People Possess
- 14:32Draw Up Rules of Engagement
- 16:43Channel the Learning through the Right People
- 18:05How Can We Trigger Alerts
- 25:33Containment to Remediation
- 33:56What Was the Most Surprising Discovery You Got from the Exercise
related talks
29mRed Teaming AWS: Practice What You Preach
12mIntroduction To Red Team Tooling And Opsec
42mRed vs. Bank: Surviving a Three Year Red Team
46mAttacking AWS: The Full Cyber Kill Chain
49mTraining for Incident Response: The Red, the Blue, and the Ugly
40mFantastic Red-Team Attacks and How to Find Them
24mPurple Teaming Like Sky’s the Limit – Adversary Emulation in the Cloud...
54mHacked in hours: Red team assessments unveiling vulnerabilities