How Cloudflare built their new DMARC Management solution entirely on top of the Workers platform.   #build   #cloudflare

A guide to managing multiple AWS Accounts using AWS Organizations and how to reduce blast radius by leveraging Delegated Administrator capabilities to avoid usage of the management root account.   #aws   #explain   #iam

Post illustrating a specific use case of SCPs that protects the security baseline, or landing zone, configuration you've created for accounts.   #aws   #defend

Public disclosure of a CloudTrail bypass in AWS Service Catalog and other logging research.   #attack   #aws

Article reviewing the different ways of triggering SSRF and discussing which mitigation techniques are most effective.   #attack   #aws   #defend

A popular passwordless authentication method is magic links. Although this is not something that Cognito supports out of the box, it can be implemented using its Lambda hooks.   #aws   #build   #iam

Article discussing in great detail what pre-signed URLs are, how to use them, and some best practices to keep in mind.   #aws   #build

Post examining multiple flaws that prevent network policies, on their own, from being an effective solution for a real-world use case.   #explain   #kubernetes

Post introducing the four types of policies available in Kubernetes (API Objects, Admission Controllers, ValidatingAdmissionPolicy, and Dynamic Admission Controls) and provide guidance on how they should be used.   #explain   #kubernetes

This article aims to address the most common or useful Kubernetes plugins for improving your security posture.   #defend   #kubernetes

Article identifying and describing some of the planned (breaking) changes for the Kubernetes v1.27 release.   #build   #kubernetes

Undocumented APIs used by the Azure Function Apps Portal menu allowed for arbitrary file reads on the Function App containers.   #attack   #azure

CLI tool for directly patching container images using reports from vulnerability scanners.

An incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer's Azure Active Directory (AzureAD), Azure, and M365 environments.

CLI tool to perform cost analysis on your AWS account with Slack integration.

Scripts and Lambdas to help with automated deployment of AWS Shield Advanced.

Passwordless authentication with Amazon Cognito: FIDO2 (WebAuthn), Magic Link, SMS OTP Step Up.

How to use managed prefix lists to simplify management of AWS Network Firewall rules and policies across a VPC.

Macie offers several capabilities to help reduce the cost of discovering sensitive data, including automated data discovery, which can reduce your spend with new data sampling techniques that are custom-built for S3.

Clean Rooms is an analytics service that helps companies and their partners more easily and securely analyze and collaborate on their collective datasets without sharing or copying each other's data.

Key AWS services and features that provide backup and recovery solutions to restore your data based upon the lessons the AWS CIRT has learned when supporting customers experiencing security events.

Google Distributed Cloud (GDC) Hosted is an air-gapped cloud solution for customers with stringent data management and sovereignty requirements.

Azure Virtual Network Manager (AVNM) is now generally available. AVNM is a one-stop shop for managing the connectivity and security of your network resources at scale.

You can now use separate encryption keys for each customer in a single hierarchical namespace enabled storage account.

You can now manage the TLS certificates associated with Listeners through Azure portal.