This article examines forensic artifacts available in GCP and provides recommendations for triage and prioritization.   #gcp   #monitor

A threat modelling exercise from NCC which demonstrated that user/tenant configuration choices matter when evaluating the overall security posture of an instance of Google Cloud Storage, and that a number of relative weaknesses can be improved through deliberate choices on behalf of the user.   #gcp   #explain

Microsoft has published a very good summary about AzureAD security trends in 2023 which considered post authentication attacks.   #attack   #azure   #defend

A deep dive on different options for abuse of legitimate S3 features with the end goal of data exfiltration, so to better understand the shortcomings of native AWS logging and monitoring tooling, and to offer some suggestions for how to go about detecting their use and abuse.   #attack   #aws   #monitor

CrowdStrike has identified a novel technique that can use the sts:GetFederationToken API to escape typical containment practices and persist in AWS environments.   #attack   #aws   #iam

Use Sigstore to sign container images and then enforce that only signed containers can run in GKE.   #build   #gcp   #kubernetes

The SLSA project announced the general availability of the SLSA 3 Container Generator for GitHub Actions, which allows any GitHub project to produce SLSA level 3 compliant provenance statements so users can verify the origin of container images they use.   #announcement   #supply-chain

CNCF and The Linux Foundation announced the upcoming Kubernetes and Cloud Security Associate (KCSA) certification.   #announcement

Native Open Policy Agent (OPA) support allows customers who have standardized on OPA to bring their policies into Terraform Cloud.   #announcement   #opa   #terraform

Dynamic provider credentials for Terraform Cloud provide a simple and safe authentication workflow for Vault and official cloud providers.   #announcement   #hashicorp   #terraform   #vault

Use ChatGPT to analyze AWS policies for vulnerabilities.

An enumeration and attack tool that allows both blue teamers and offensive security practitioners to evaluate the blast radius of a compromised personal access token within a GitHub organization.

A demo/testing OIDC token issuer. It will accept any claims as query parameters and mint valid OIDC tokens with them.

Generate a score for your sbom to understand if it will actually be useful.

Instant K8s service dependency map, right to your Grafana.

AWS announced support of ingestion for activity events from non-AWS sources using CloudTrail Lake, making it a single location of immutable user and API activity events for auditing and security investigations.

With AWS IAM Identity Center you now have the option to configure the appropriate session duration for your organization's needs while using new session management capabilities to look up active user sessions and revoke unwanted sessions.

How to use third-party secrets manager as the source of truth for secrets, while replicating a subset of these secrets to AWS Secrets Manager.

You can now configure your NAT Gateway to support up to 440,000 concurrent connections to a unique destination by adding multiple IP addresses to same NAT Gateway.

Google announced Mandiant Attack Surface Management for Google Cloud, which can enable customers to centralize visibility into cloud-hosted external assets.

How IAM is implemented on BigQuery datasets via Terraform and how to correctly assign and preserve authorized view permissions without running into the chicken and egg problem.

GVisor rolled out two file system performance improvements to GKE and Serverless: VFS2 and LISAFS. These bring gVisor performance closer to native.

Google Cloud's Security Command Center is now available on a project-level basis, with pay-as-you-go options.

AKS's Free tier allows you to only pay for the virtual machines, and associated storage and networking resources consumed, and you get the managed Kubernetes control plane for free.