ABOUT
Cloud village is an open space to meet folks interested in offensive and defensive aspects of cloud security. The village is home to various activities like talks, workshops, CTFs and discussions targeted around cloud services.
If you are a professional who is looking to gain knowledge on securely maintaining the cloud stack and loves to be around like-minded security folks who share the similar zeal towards the community, Cloud Village is the perfect place for you.
Cloud Village will be in-person at DEF CON, Arab International Cybersecurity Conference (AICS) at Exhibition World Bahrain from 5th to 6th November 2025
Hope to see you all there!
Schedule
+
11:30 - 12:00
TALK | STRIDE or Die - An AI's Guide to Threat Modelling in the Cloud
+
Speaker: Tanzeel Rehman
Venue: Room C16, Talks/Labs Area
Abstract:
Traditional threat modelling is broken. In the high-stakes, tightly regulated world of financial services, it’s a bottleneck—slow, inconsistent, and struggling to keep pace with agile development in the cloud. As a Cloud Security Architect at a major UK bank, I saw this problem firsthand. So, I decided to do something about it. On my own. This talk is the story from the trenches of developing a prototype for an AI-assisted cloud threat modelling program. I’ll dive deep into the Retrieval-Augmented Generation (RAG) architecture I built, the dark art of data chunking for complex corporate and regulatory documents, and the prompt engineering required to make an LLM think like a paranoid security architect. I'll share my scars and my wins: from the AI hallucinating compliance controls during a crucial early demo, to uncovering subtle risks a human might miss. You'll walk away with a practical blueprint for how to leverage AI to augment your security practice, a clear-eyed view of the challenges involved, and the story of how a grassroots project can build a defensible, auditable, and scalable threat modelling process that actually works. It's time to get the buy-in.
Speaker Bio:
Cloud Security Architect at Lloyds Banking Group with a pivotal role in securing the UK financial sector. My career is defined by the intersection of advanced cybersecurity and law, holding both an LL.B. and a call to the Bar of England and Wales (2019). This dual expertise allows me to build and assess security frameworks that are resilient by design and compliant by default.
In my current role, I advise on the security posture of the bank's most critical infrastructure, including cloud infrastructure and solution. I collaborate with and guide senior leadership, fellow architects, and engineers to ensure our strategy effectively mitigates risk.
+
12:15 - 14:15
LAB | Breaking Boundaries: Multi-Cloud Red Teaming through Misconfigurations
+
Speaker: Syed Modassir Ali
Venue: Room C16, Talks/Labs Area
Abstract:
Cloud boundaries aren’t walls—they’re doors waiting to be misconfigured. In this workshop, we’ll follow the path of an adversary who starts with a vulnerable applications and pivots into through weak trust policies and misconfiguration. Along the way, we’ll explore persistence tricks, exfiltration, and map each step to MITRE ATT&CK. Attendees will walk away with a red team playbook on how small missteps create massive multi-cloud compromises—and how to spot them before attackers do.
Outline:
1. Introduction: Cloud and Red Teaming 101 and Why multi-cloud misconfigurations are dangerous Quick overview of the attack chain MITRE ATT&CK mapping.
2. Introduction to Identity and Access Management in AWS and Azure.
3. Azure Labs- Starting with a vulnerable applications Enumerating roles and permissions Identifying overly permissive access Extracting secrets.
4. AWS Labs – Starting with a vulnerable lambda function and enumerating IAM Roles, policies and misconfigurations with the final objective of extracting secrets.
5. Map each attack step to MITRE ATT&CK and
6. Wrap-Up & Defense - Discuss on detection opportunities.
Prerequisites:
- Attendees should have a basic understanding of cloud platforms (AWS, Azure), core IAM concepts, and networking fundamentals (IP addressing, routing, firewalls).
- Familiarity with penetration-testing ideas and comfort using command-line tools will help, and participants should bring a laptop with the aws cli, az cli and powershell installed. A modern browser and a stable internet connection.
- Access to Powershell to follow along the Azure labs and aws cli to follow along on the AWS labs.
- The workshop is aimed at beginners with some security exposure to cloud. Level: Intermediate.
Speaker Bio:
Syed Modassir Ali is a Red Team Security Engineer with experience in adversary simulations, penetration testing, and exploit development across cloud and enterprise environments. He has spoken at REDCON, OWASP JGEC, DEFCON DC9111, BSides Pune, and Null meetups, and has been actively associated with Cloud Village for the past two years. A passionate community contributor and multiple-time CTF champion, he holds advanced certifications including OSCP, OSED, OSEP, CRTO, and CARTP, and focuses on offensive security research to help organizations understand and defend against modern attack paths.
Cloud Village CTF
Cloud Village CTF @ DEFCON Bahrain: 05th November, 2025 (On-Site)
CTF starts: 05th November, 2025 - 9AM GMT +3(AST)
CTF closes: 06th November 2025 - 11AM GMT +3(AST)
CTF registration opens on 05th November, 2025 - 9AM GMT +3(AST)
CTF Site: https://ctf.cloud-village.org
Room No.: Cloud Village - CTF Area, C16, Exhibition World Bahrain
If you ever wanted to break stuff on the cloud, or if you like rabbit holes that take you places you did not think you would go to, follow complicated story lines to only find you could have reached to the flag without scratching your head so much - then this CTF is for you!
You can register as teams or go solo, use hints or stay away from them, in the end it will be all for glory or nothing.
See you on the other side!