Noah McDonald

GCP Consultant @googlecloud | Ex-Unit42 | Cloud Security | @[email protected]

[Noah McDonald @TheIceRoot]

@cybersecstash Thanks for sharing!

[Noah McDonald @TheIceRoot]

@anton_chuvakin Hot take, we need to train our users before we train the AI

[kat traxler @NightmareJS]

I was recently pointed to some #fresh GCP documentation from @TheIceRoot
For your reading pleasure is a complete list of P4SAs (per-project-per-product) Service Accounts and their default roles 📯
https://t.co/vlxzZXKY9K

[Noah McDonald @TheIceRoot]

@ken5scal Thanks for sharing!

[Noah McDonald @TheIceRoot]

@DCICyberSecNews Thanks for sharing!

[Noah McDonald @TheIceRoot]

@Typhon666_death Thanks for sharing!

[Noah McDonald @TheIceRoot]

@francescofaenzi @anton_chuvakin Thanks for sharing!

[francescofaenzi @francescofaenzi]

#Google #GCP attack matrix
#TrustEverybodyButCutTheCards

Courtesy of: Noah McDonald https://t.co/6gbuWC21gS

[Clint Gibler @clintgibler]

☁️ Google Cloud Incident Response Cheat Sheet

* Overview of IR in GCP
* Logs for threat hunting and incident response
* Log analysis
* Service accounts
* GCP attack matrix

By @TheIceRoot

#cybersecurity #infosec

https://t.co/mpGrbrPeeX

[fwd:cloudsec @fwdcloudsec]

We've lined up a venue for fwd:cloudsec 2024! Mark your calendars for June 17-18 in Arlington, VA. Ticket sales and CFP will open in early January. For those interested in sponsoring, we'll have a prospectus in the next few weeks. Email [email protected] if interested.

[SecTor Security Con @sectorca]

Ever wonder how attackers breach the cloud? Jay Chen and Noah McDonald will walk through common cloud attack vectors and a real breach incident in this #sectorca presentation, starting at 2:45 in 714AB. https://t.co/VPHqIikKyq

[SecTor Security Con @sectorca]

85% of organizations have hard-coded credentials in VMs, say Jay Chen and Noah MacDonald. Their talk on cloud oversight is ongoing at #sectorca in 714AB. https://t.co/VPHqIikKyq

[SecTor Security Con @sectorca]

We just heard all about how upset gamers compromised the cloud with SIM-Swap, thanks to Jay Chen and Noah McDonald at #sectorca. They're wrapping up now in 714AB. https://t.co/VPHqIikKyq

[Noah McDonald @TheIceRoot]

If you are at #SecTor today, come check out my talk on real world cloud attacks! #cloud #blackhat https://t.co/jTbR7JKvWy

[Noah McDonald @TheIceRoot]

@NightmareJS Agreed, but people can easily do a better job of locking down their service accounts. It’s up to us to educate them :)

[Noah McDonald @TheIceRoot]

Google’s Threat Horizon report, out now! https://t.co/WZonyLr6Ol

[Noah McDonald @TheIceRoot]

I am excited to announce that my colleague Jay Chen and I got accepted to @BlackHatEvents SecTor!! https://t.co/jTbR7JKvWy

[kat traxler @NightmareJS]

Unfortunately @orcasec got their terminology wrong in their report by calling the cloud build SA , a ‘Default SA’, then I PERPETUATED it! - apologies. There are only 2 default SAs. The compute and app engine SA. The Cloud Build SA is not a default SA, it is a P4 SA. 1/3

[Noah McDonald @TheIceRoot]

@cloudvillage_dc @defcon How long until the submitters should hear back? I haven’t received an approval or denial email yet

[Noah McDonald @TheIceRoot]

Spotify released how they analyze volatile memory in Google Kubernetes Engine. Love the details! #secops #containers #forensics https://t.co/54hbFIi2PR