On this Screaming in the Cloud Replay, we’re taking you back to our chat with Nick Frichette. He’s the maintainer of hackingthe.cloud, and holds security and solutions architect AWS certifications, and in his spare time, he conducts vulnerability research at Hacking the Cloud. Join Corey and Nick as they talk about the various kinds of cloud security researchers and touch upon offensive security, why Nick decided to create Hacking the Cloud, how AWS lets security researchers conduct penetration testing in good faith, some of the more interesting AWS exploits Nick has discovered, how it’s fun to play keep-away with incident response, why you need to get legal approval before conducting penetration testing, and more.

Show Highlights

(0:00) Intro

(0:42) The Duckbill Group sponsor read

(1:15) What is a Cloud Security Researcher?

(3:49) Nick’s work with Hacking the Cloud

(5:24) Building relationships with cloud providers

(7:34) Nick’s security findings through cloud logs

(13:05) How Nick finds security flaws

(15:31) Reporting vulnerabilities to AWS and “bug bounty” programs

(18:41) The Duckbill Group sponsor read

(19:24) How to report vulnerabilities ethically

(21:52) Good disclosure programs vs. bad ones

(28:23) What’s next for Nick

(31:27) Where you can find more from Nick

About Nick Frichette

Nick Frichette is a Staff Security Researcher at Datadog, specializing in offensive security within AWS environments. His focus is on discovering new attack vectors targeting AWS services, environments, and applications. From his research, Nick develops detection methods and preventive measures to secure these systems. Nick’s work often leads to the discovery of vulnerabilities within AWS itself, and he collaborates closely with Amazon to ensure they are remediated.

Nick has also presented his research at major industry conferences, including Black Hat USA, DEF CON, fwd:cloudsec, and others.

Links

• Hacking the Cloud: https://hackingthe.cloud/
• Determine the account ID that owned an S3 bucket vulnerability: https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/
• Twitter: https://twitter.com/frichette_n
• Personal website:https://frichetten.com

Original Episode

https://www.lastweekinaws.com/podcast/screaming-in-the-cloud/hacking-aws-in-good-faith-with-nick-frichette/

Sponsor

The Duckbill Group: duckbillgroup.com

On this Screaming in the Cloud Replay, Corey is joined by Nipun Agarwal, Senior Vice President of MySQL HeatWave Development at Oracle, to discuss the release of MySQL HeatWave and how it will benefit users among the sea of database offerings on AWS. Nipun reveals why Oracle decided to develop HeatWave, how HeatWave is providing meaningful cost savings to users, and how HeatWave has been optimized for the cloud. Nipun explains how they’ve lowered the barriers to entry for new users of HeatWave, and Oracle’s focus on implementing customer feedback when developing new offerings.

Show Highlights

(0:00) Intro

(0:55) The Duckbill Group sponsor read

(1:28) The significance of HeatWave coming to AWS

(2:20) What is MySQL HeatWave?

(5:13) What jumped out to Corey during his conversations with Nipun on Oracle

(8:40) What’s “under the hood” of MySQL HeatWave

(14:12) How Oracle built out its pricing for MySQL HeatWave

(16:41) Why MySQL HeatWave doesn’t show up on AWS bills

(21:27) The Duckbill Group sponsor read

(22:09) Oracle’s historical customer base and the company’s credit system

(24:30) The point behind MySQL HeatWave

(27:51) How MySQL HeatWave runs

(33:53) Where you can find more from Nipun and Oracle

About Nipun Agarwal

Nipun Agarwal is a Senior Vice President, MySQL HeatWave and Advanced Development, Oracle. His interests include distributed data processing, machine learning, cloud technologies and security. Nipun was part of the Oracle Database team where he introduced a number of new features. He has been awarded over 170 patents., Nipun Agarwal is Senior Vice President of MySQL Database & HeatWave Development. He leads a global engineering organization responsible for Oracle’s MySQL innovations that enable organizations to use a single database for both transactional and analytical workloads. His interests include data processing, distributed systems, machine learning, cloud computing and security. Prior to his current position, Nipun was with Oracle Labs and the Oracle Database team, where he introduced a number of new features. He has been awarded over 175 patents.

Links

• Oracle: https://oracle.com
• MySQL HeatWave info: https://www.oracle.com/mysql/
• MySQL Service on AWS and OCI login (Oracle account required): https://cloud.mysql.com

Original Episode

https://www.lastweekinaws.com/podcast/screaming-in-the-cloud/heatwave-and-the-latest-evolution-of-mysql-with-nipun-agarwal/

Sponsor

The Duckbill Group: duckbillgroup.com

The tech industry is getting long enough in the teeth that now there are some bonafide old fogeys. Nevertheless there, fortunately, are plenty of younger tech folks out there pushing the thought and mentality of the industry forward. Andrew Brown, Co-Founder and Cloud Instructor at ExamPro Training Inc certainly is, but his presence in the community is so much more! On this Screaming in the Cloud Replay, Andrew talks about the various internet platforms that he stays active on, and his mission to provide education on the cloud. Importantly so, Andrew does so with an immense amount of generosity. As he puts it, he couldn’t imagine taking money for the courses that he has created. Andrew and Corey discuss at length their thoughts on cloud certifications, the worth of multicloud, and much more!

Show Highlights

(0:00) Intro

(0:41) The Duckbill Group sponsor read

(1:15) Why Corey struggles to keep up with Andrew’s impressive online presence

(2:47) Explaining ExamPro

(6:39) The troubles of online “experts”

(13:01) Andrew’s thoughts on using certifications as proxies

(18:14) The value of certification vs. your level of experience

(22:47) The Duckbill Group sponsor read

(23:30) Should engineers learn more than one cloud provider?

(27:10) Is multi-cloud actually the way to go?

(34:31) Where you can find more from Andrew

About Andrew Brown

Andrew Brown has been working in tech 15 years. Today, he creates free cloud certification courses where he teaches people Cloud, DevOps, Data, ML, Security, K8s and Serverless.

Links

• ExamPro Training, Inc.: https://www.exampro.co/
• PolyWork: https://www.polywork.com/andrewbrown
• LinkedIn: https://www.linkedin.com/in/andrew-wc-brown
• Twitter: https://twitter.com/andrewbrown

Original Episode

https://www.lastweekinaws.com/podcast/screaming-in-the-cloud/learning-to-give-in-the-cloud-with-andrew-brown/

Sponsor

The Duckbill Group: duckbillgroup.com