Eric Johnson

SANS 2026 Cloud Security Exchange with AWS, Google and Microsoft

Join the 5th annual SANS Cloud Security Exchange—a one-of-a-kind virtual event where cloud and cybersecurity experts from SANS Institute, Amazon Web Services, Google Cloud, and Microsoft will come together to share thought leadership and technical insights.

AI-Driven DevSecOps: Protecting Kubernetes Microservices with the Kong Ingress Controller

Microservices and AI-generated code expand your attack surface fast. In Part 2, learn how to use kubectl-ai, the Kubernetes Gateway API, and Kong Ingress Controller to identify exposed services and enforce secure, centralized traffic controls.

When the Security Scanner Became the Weapon: Inside the TeamPCP Supply Chain Attack

Security tools are no longer just defenses, they’re targets. This sessions explores how attackers are weaponizing scanners, exploiting CI/CD pipelines, and turning trusted tooling into attack vectors.

Securing Gen AI RAG Data using Azure AI Search

Large Language Models (LLMs) and Generative AI have inherent limitations, such as outdated knowledge, lack of private data access, and the potential for hallucinations. In this session, we will introduce a strategy for overcoming these challenges: Retrieval-Augmented Generation (RAG).

Cloud Native Security Part 3: Continuous Compliance with Prowler

The Cloud Native Computing Foundation (CNCF) 2024: The Top Data Trends Driving the Future of the Enterprise report estimates that 80% of new and refactored applications are being built to run on cloud native platforms, with Kubernetes powering the infrastructure.

Cloud Native Security Part 1: Scaling DevSecOps with GitLab Cl

The 2024 Accelerate State of DevOps report shows that software delivery is faster than ever, with 41% of teams deploying systems more than once a week. As speed increases, the average change control lead time has dropped to less than a week.

Cloud Security: First Principles and Future Opportunities Part 2 of 5 - Secure by Design: Elevating Security Beyond Defaults

Part 2: Secure by Design: Elevating Security Beyond DefaultsIn Part 2 of this series, we focus on how Secure by Design (SbD) shifts development approaches to integrate security from the ground up, reducing risks early and creating systems that are resilient and secure by default.

Future-Proof Your Skills for 2025’s Cybersecurity Challenges

As the digital landscape continues to evolve, so do the threats that put organizations at risk. With 2025 on the horizon, the urgency to anticipate and prepare for emerging cybersecurity challenges has never been greater. This webcast is designed specifically for cybersecurity practitioners who are looking to future-proof their skills and defenses to combat these challenges.

Executive Order 14028: Improving the nations cybersecurity: Identity

Microsoft is committed to building products to help government agencies and critical infrastructure companies improve national cybersecurity. This webinar will cover how Microsoft Entra ID helps organizations meet the identity requirements of the Executive Order.

Aviata Cloud Solo Flight Challenge Chapter 5: Centralizing Cross Cloud Security Events

Captain KubeAce Maverick and the Aviata team are still reeling from the Kubernetes attack that resulted in the theft of their valuable flight plan and pilot data.

Centralizing Cloud Logs and Events with Microsoft Sentinel

In this webcast, join the authors of SEC549: Cloud Security Architecture to explore the push and pull logging architecture used by Microsoft Sentinel to ingest cross-cloud audit logs. Attendees will see the log journey from both AWS CloudTrail and Google Cloud Audit Logs into Microsoft Sentinel and learn some fun Kusto Query Language (KQL) queries to investigate cloud events.

Cloud Flight Simulator Part 4: Least Privileged Pods with Kubernetes Workloads

In the final part of the Cloud Security Flight Simulator series, join SEC540 lead author and instructor Eric Johnson to learn how to enable workload identity for AWS Elastic Kubernetes Service (EKS) and Azure Kubernetes Service (AKS).

Cloud Flight Simulator Part 1: GitLab CI, Workflows, and Secrets

Before you can help DevOps teams solve security problems and improve their security programs, you need to understand how they think, how they work, and the tools that they use.

Hands-On Workshop: Destroying Long-Lived Cloud Credentials with Workload Identity Federation

Attackers have been breaching the cloud for years by stealing long-lived credentials. To combat these attacks, cloud providers have been building improved authentication workflows for external identity providers. This workshop explores Workload Identity Federation and how you can replace long-lived cloud credentials with short-lived tokens signed by an OpenID Connect identity provider.

Securely Integrate Multicloud Environments with Workload Identity Federation

Organizations are becoming multicloud by choice or by chance. Many of them integrate their multiple clouds with one another to improve Availability, support Disaster Recovery, and leverage the services from each provider that best fits their needs.

Breaking the Cloud Kill Chain

Organizations are moving data and applications into public cloud services at a rapid pace. As the public cloud footprint expands, red teams and attackers are reinventing the kill chain in the cloud. Public cloud services provide new, creative ways to discover assets, compromise credentials, move laterally, and exfiltrate data. In this webcast, Eric Johnson (SEC510 and SEC540 author) explores common cloud attack techniques from the MITRE ATT&CK Cloud Matrix. For each technique, we will analyze misconfigurations, exploitation paths, and common architecture patterns for breaking the kill chain.