Major cloud providers give admins a free, browser-based CloudShell. It’s a powerful container environment that most security teams never think to secure, and threat actors have noticed. Attackers can hijack CloudShells for bot networks, cryptomining, or deeper access into your cloud environment. Defenders, meanwhile, have no playbooks, few lockdown controls, sparse logging, and limited remediation options, and initial access often hides behind API credentials. In this webcast, Jenko Hwong, Principal Threat Researcher at Huntress Labs, demonstrates how CloudShell containers get compromised and what you can do about it.

You’ll learn:

• How attackers abuse CloudShell environments, shown through a hands-on demo
• Which lockdown controls exist today and where the gaps remain
• How to detect CloudShell abuse despite limited logging
• Practical options for remediating a compromised CloudShell

GIAC and ISC2 members can earn partial CPE credits for attending this webcast live.