GCP CL_WHY: The Hacker’s And The Hero Guide To The CLI

The Google Cloud Platform Command Line Interface (GCP CLI) is a powerful tool for developers and administrators, but it poses a significant risk when exploited by threat actors. This talk explores how threat actors can leverage the GCP CLI for initial access and data exfiltration. We'll examine the GCP CLI, its associated credentials, how attackers steal these credentials, and ways they can bypass misconfigured security controls. Crucially, we'll delve into a multi-layered defense strategy to secure the GCP CLI. Finally, the talk will cover proactive detection methods to alert you to GCP CLI-based intrusion attempts. Join this session to learn how to effectively protect your cloud environment against these sophisticated attacks.