fwd:cloudsec

Speaker: Greg FossGreg Foss is a seasoned cybersecurity leader with over 15 years of experience spanning threat research, security operations, and offensive security. As the Engineering Manager of Threat Detection Engineering at Datadog, he leads a team of elite threat hunters and detection engineers, developing cutting-edge defenses against sophisticated cloud-native intrusions by nation-state and criminally motivated adversaries. His team transforms deep research and intelligence into actionable security insights, strengthening Datadog’s security platform.Speaker: Anthony RandazzoAnthony Randazzo leads the detection engineering function at Datadog on their cloud security platform. He has nearly 20 years of experience in security operations roles across SecOps management, detection engineering, incident response, and threat intelligence. He’s been particularly focused on cloud-native threat management across these newer attack surfaces the past 6 years.Talk:Although AWS has been around for over 15 years, cloud threat hunting remains a relatively nascent discipline. While opportunistic threats like cryptocurrency mining are well-known, large-scale, cascading attacks targeting cloud-native infrastructure are less frequently discussed.Over the past 18 months, we’ve significantly expanded our cloud threat hunting operations using vendor-agnostic strategies to better understand these emerging threats. This talk will outline our unique approach, which combines hypothesis-driven investigations, TTP-based hunts, and anomaly detection to proactively uncover threats at scale. We’ll also highlight our experiments with broader, cross-functional hunt operations that extend beyond our core team.Attendees will gain insights from our large-scale cloud attack surface analysis and walk away with a deeper understanding of the evolving cloud-native threat landscape.

https://youtu.be/WXdB-9pTqAU

Speaker: Naor HazizNaor Haziz is a security researcher and low-level developer at Sweet Security with over seven years of experience in vulnerability research, exploit development, and system internals. He holds a degree in Computer Science and previously served as an officer in the IDF Intelligence Corps, leading a team focused on Windows and Linux security. At Sweet Security, he develops the company’s security sensor, designing and implementing high-performance detection capabilities for cloud environments. His work combines low-level development and cloud security research to improve monitoring, threat detection, and defense mechanisms, ensuring robust protection for modern cloud infrastructures against evolving security threats.Talk:Hijacking Privileges in the Cloud: Breaking Role Boundaries in Amazon ECSModern cloud environments rely on fine-grained identity and access management (IAM) to enforce security boundaries. But what happens when those boundaries break? In our research, we uncovered a vulnerability in an undocumented Amazon ECS protocol that allows a low-privileged role running on an EC2 instance to hijack the IAM privileges of higher-privileged containers on the same machine.This talk will explore the technical details of this attack and how it exploits shared infrastructure in containerized environments. In addition, we will provide best practices on avoiding role co-location risks, ensuring that high-privilege tasks are never deployed alongside low-privilege workloads in ways that could allow privilege hijacking.

https://youtu.be/WUO_-Agpcxs

Speaker: Ofir BalassianoOfir Balassiano leads AI and Cloud security posture research at Palo Alto Networks, uncovering critical vulnerabilities in GCP and Azure. With over a decade of experience in security, he has a proven track record of impactful research and innovative solutions. Prior to Palo Alto Networks, Ofir served as head of security at Dig Security, driving key security initiatives, and as a senior researcher at XM Cyber, where he specialized in Windows internals and EDR strategies. His career began in the IDF, where he led a team focused on advanced security technologies. His expertise spans cloud security, OS hardening, and penetration testing, with a unique ability to analyze and secure systems from both offensive and defensive angles. His work continually influences best practices in cloud security, keeping organizations ahead of emerging threats.Speaker: Ofir shatyOfir Shaty, a seasoned Senior Security Researcher at Palo Alto Networks, boasts an impressive 8-year track record in the realms of Data Security, Web Application and Cloud Security. With a specialized focus on researching cloud and database attacks, he has contributed groundbreaking research to the field, exploring both offensive and defensive strategies and attack techniques. Notably, Shaty demonstrated his expertise by disclosing vulnerability in multiple GCP services.Talk:Tenant Projects are the backbone of services in GCP, yet their architecture remains largely misunderstood- even by seasoned cloud security practitioners. This talk takes a deep dive into how GCP implements Tenant Projects, how permissions and interconnected services are structured, and where the cracks start to form.As part of our research into Vertex AI, we uncovered vulnerabilities that not only compromised Vertex AI itself but also exposed fundamental weaknesses in the Tenant Project model. By understanding the permission model and service interactions, we were able to escalate our findings and take full control over an entire Tenant Project.We’ll walk through the architecture, highlight the risks, and show real-world exploitation scenarios- unveiling for the first time additional vulnerabilities beyond our initial discoveries. This talk isn’t just about the bugs; it’s about how attackers can abuse the Tenant Project model and what security teams need to do to defend against it.Expect a mix of deep technical content, hands-on exploitation, and a broader discussion on the implications of GCP’s multi-tenant architecture.

https://youtu.be/Pd6rbBjiXaA

Speaker: Agnel AmodiaI’m Agnel Amodia, a Senior Technical Lead at Vanguard Group, specializing in Identity and Access Management. With over 15 years of experience, including 7 years in cloud security, I design enterprise-grade security systems for AWS cloud databases. Previously, I worked as a system programmer and researcher in India, building Neural Network Machine Learning-based software for the National Crime Records Bureau. I’m also a passionate security researcher who loves finding loopholes and crafting solutions. For me, security isn’t just work — it’s a passion I truly enjoy.Talk: Data Perimeter Implementation Strategies: It is one thing to know how to configure SCPs/RCPs, and another for your organization to implement themAWS IAM is getting more and more complex—permissions policies, permission boundaries, session policies, resource-based policies, service control policies, and now the latest buzz: Resource Control Policies (RCPs). Defining security boundaries on paper? That’s the easy part. But rolling them out across hundreds of AWS accounts running critical financial applications—that’s where things get tricky.At Vanguard, we found a way to keep security tight without slowing things down. Instead of being the impeding team, we focused on making cloud security an enabler, not a blocker. In this talk, we’ll share how we built and deployed SCPs and Resource Control Policies (RCPs) to set security boundaries at scale—without causing downtime for business applications.While implementing data perimeter controls with layered strategy, we ran into some real-world challenges. Challenges such as Dynamic VPC IDs and corporate CIDR made it tough to keep SCPs up to date, Resource Control Policy does not support global condition key for S3 bucket service, integrating defense-in-depth CI/CD pipeline controls with data perimeter controls and protect identities/resources from being tagged from aws console. Finally, verifying the effectiveness of these controls was non-trivial because of inconsistent access denied patterns.

https://youtu.be/M1hXUcBMf1Q

Speaker: Dhruv AHUJADhruv is a former SRE and founded Chaser Systems in 2020. He's mostly Wiresharking, tinkering with PKI or tuning stacks as he once did in the low-latency world of financial data, only this time for network security. He is also a Rust programmer, cares deeply about developer experience, dabbles in cryptography and holds a master's degree in Advanced Software Engineering from King's College London. He's always 5 years of practice away from being able to play Chopin on the piano – an accomplishment that will surely coincide with IPv6 overtaking IPv4.Talk:This talk will explore a lesser-known technique for deploying IAM Roles Anywhere on platforms without a key management service or secret storage, safely.An impediment to the adoption of IAMRA is the absence of an existing PKI solution, or the expense and expertise needed to run a Private CA. Therefore, we will look at integrating Route 53 with an ACME-enabled PKI, such as Let's Encrypt, for device enrollment with autonomous short-lived certificate issuance.Come along for a deep dive into:(1) Configuring IAMRA with targeted CA certificates.(2) Certificate Attribute Mappings for client authentication.(3) The corresponding Trust Policy on a Role.(4) Extending AWS SDK via their credential helper so temporary session credentials are transparently returned to the calling process.We will also build detection for abuse of private keys from logs in CloudTrail, should they leak.For contrast, using a hardware-backed private key store, such as Yubikey, with an ACME-enabled PKI will also be demonstrated.

Speaker: Dani KaganovitchDani Kaganovitch is a Product Manager at RockSteady, a stealth cloud security startup. Before that, Dani worked at Google Cloud and Oracle Cloud, helping customers navigate various cloud use cases at scale in areas of core infrastructure workloads, FinOps, and observability. Through working with hundreds of organizations of different sizes, Dani organized and presented technical workshops at conferences, which led to becoming an advocate for effectively and efficiently solving real-world multi-cloud security challenges. Now, Dani focuses on ensuring customers’ environments are secure by design through the application of security policies that are practical, enforceable, and don’t break production.Talk:Oracle Cloud Infrastructure (OCI) has its own approach to security and policy enforcement, which differs significantly from AWS, Azure, and GCP.While organizations moving to OCI expect familiar security controls, OCI Governance Rules, IAM Policies, and Security Zones operate differently from AWS SCPs, RCPs, and Declarative Policies, Azure Policies, and GCP Org Policies.This session will break down what security practitioners need to know about OCI’s security model, how its enforcement mechanisms compare to other cloud providers, and example use-cases for integrating OCI into a multi-cloud security strategy.

https://youtu.be/9-e4VVPlWB8

Speaker: Jake Berkowsky

Jake is a Principal Architect heading Snowflake's Cybersecurity Data Cloud. At Snowflake, Jake's mission is to evangelize and enable the implementation of modern security analytics and engineering. Prior to joining Snowflake, Jake has had a diverse background of technical and leadership roles having most recently served as Co-Founder and CTO of a Cloud Consulting and Data Intelligence company. He regularly maintains his experience and interests in the areas of cloud, devops and development and is an active outdoorsman and nature enthusiast.Talk:Once again what's old is new. Its looking like MCP is gonna be here for awhile so its only a matter of time before an enabled developer asks for sign off on something that works great on their local.This lightning talk is geared to provide cloud security professionals with an up to date understanding of best (or least bad) practices. We’ll cover:Layers of uncertainty: With a spec in active development and not even a transport layer fully agreed upon, how do you approach deploying something before the recommended architectures are even decided on?Trends: What are other folks doing? Is OAuth actually feasible? What else has been done? How are people working around limitations and what are the risks? What is SSE, why is it deprecated but still implemented everywhere and what do I do when they tell me it "needs websockets"?Documented paths forward: What is the community doing? What standards have been released to help align? What tools and frameworks exist to make our jobs easier?What could go wrong? A dive into cloud specific threat vectors, covering the theoretical and maybe even real world incidents

Speaker: Seth ArtSeth Art is currently a Security Researcher & Advocate at Datadog. Prior to joining Datadog, Seth created and led the Cloud Penetration Testing practice at Bishop Fox. He is the author of many open source tools including BadPods, IAMVulnerable, and CloudFoxable, and the co-creator of the popular cloud penetration testing tool, CloudFox.Talk:It’s not every day you stumble upon a technique that enables remote code execution (RCE) in thousands of AWS accounts at once—but that’s exactly what happened with the whoAMI attack. By researching a known misconfiguration through a new lens, we discovered how to gain access to thousands of AWS accounts that unknowingly use an insecure pattern when retrieving AMI IDs.In this talk, I’ll walk you through how we uncovered the whoAMI attack, how we confirmed the attack works, and how we even identified vulnerable systems that were internal to AWS. We’ll explore the surprisingly diverse ways developers manage to shoot themselves in the foot by omitting the owners attribute, and share how difficult it was to build and refine detections for this anti-pattern that minimized false positives (and false negatives).Finally, we’ll focus on how you can spot and fix this misconfiguration in your own environment, covering a range of defense-in-depth strategies for both prevention and detection. This is a roller-coaster tale of cloud security research—full of ups and downs and twists and turns. And like every roller coaster I’ve ever been on, it lasted longer than I expected– or wanted it to.

https://www.youtube.com/watch?v=1rfB0Pb0t2o

Speaker: Shahar Dorfman

Shahar is a threat hunting researcher at Wiz, where she focuses on identifying and analyzing emerging cyber threats to enhance security defenses.

Speaker: Sagi Tzadik

Sagi Tzadik is a security researcher on the Wiz Research team. His expertise lies in identifying and exploiting vulnerabilities in web applications, as well as in network security and protocols. He has been recognized for his work and was featured on the MSRC Top Security Researcher Leaderboard.

Talk: Malicious actors often exploit persistent threats to maintain long-term access to target systems by leveraging vulnerabilities and common misconfigurations. This is especially problematic in environments like appliances, where legitimate administrators may not have direct access to the file system, making detection and remediation even more difficult.In this session, we will walk you through our approach, which leverages a significant advantage of cloud environments: the ability to collect metadata at scale from a diverse range of products, including appliances. We will examine two real-life case studies where we used this technique, along with extensive metadata analysis, to uncover previously undetected threats.Join us in this session to learn how we've enhanced security through metadata analysis and improved detection, and to explore how we can collaborate to strengthen defenses across harder-to-monitor systems like appliances.

https://www.youtube.com/watch?v=p8PZiqXoVTc

An introduction to fwd:cloudsec North America 2025 by Aaron Zollman