A post arguing for stronger software engineering skills in cybersecurity, and a focus on data engineering.   #strategy

Slides from a KubeCon EU 2023 talk which describes common security pitfalls in managed Kubernetes environments.   #explain   #kubernetes

A report which summarizes the survey responses of 400 security leaders and SecOps practitioners in North America regarding the capabilities, practices, and behaviors of protecting against, identifying, and remediating cloud-based threats.   #strategy

Jetstack shares some container security best practices, including using minimal base images, running as non-root users, managing secrets, signing images, and generating SBOMs.   #build   #containers   #explain

Slides from a session that covered the latest cloud focused attack vectors and described viable strategies on how to detect their malicious usage within your cloud environments.   #attack   #aws   #azure   #gcp

A look at how capabilities are used in Linux and container systems.   #containers   #explain

A novel technique which uses AWS CloudTrail to detect the use of stolen credentials.   #aws   #monitor

Commodity threat actors have recently begun to exploit cloud environments for smishing campaigns, employing techniques strikingly similar to those used in SES enumeration and abuse.   #attack   #aws

Techniques attackers might use to exploit cloud tokens and gain access to resources. Strong token management, limiting privileges, and token revocation policies help mitigate risks.   #attack   #azure

A container escape vulnerability, combined with accidental 'write' permissions to a private registry, opened a backdoor for Wiz Research to access Alibaba Cloud databases and potentially compromise its services through a supply-chain attack.   #alibaba   #attack

A persistent Service Account private key exfiltration privilege escalation technique that potentially affected Google Cloud Service Accounts, now remediated promptly by the Google Cloud team.   #attack   #gcp

For the first time evidence that attackers are exploiting Kubernetes Role-Based Access Control (RBAC) in the wild to create backdoors.   #attack   #kubernetes

NCC Group performed a security evaluation of Kubernetes 1.24.0 release. Key findings included concerns with the administrative experience, flaws in communication between the API Server and the Kubelet which may result in an elevation of privilege, and flaws in input sanitization which provide a limited authorization bypass.   #attack   #kubernetes

Kubernetes 1.27 introduced a new feature called Node log query that allows viewing logs of services running on the node.   #kubernetes   #monitor

After almost two years since SLSA's initial preview release, the first official stable version, SLSA v1.0, has been released.   #announcement   #supply-chain

All-in-one auditing toolkit for identifying common security issues in managed Kubernetes environments.

A curated list of awesome AWS Lambda Layers.

Slack alert bot for matching Github Audit Events.

A tool that will enumerate data about all active IAM access keys across an AWS Organization and will enrich each key with account tag information.

Recon tool for cloud provider attribution.

How to use principles of attribute-based access control (ABAC) to define dynamic IAM permission policies in AWS IAM Identity Center by using user attributes from an external identity provider (IdP) and resource tags in Secrets Manager.

Post walking through different AWS Backup features that you can use to implement a centralized immutable backup solution to implement protections against unauthorized access to your backup data in your central backup account.

IAM Access Analyzer helps to identify resource policies that allow public access, and prioritizing the findings can be done by focusing on resources that are critical to business operations and data privacy. Use resource tagging for easier organization and filtering, and continuously monitor and remediate findings.

This post focuses on creating an IAM OIDC identity provider for GitHub and demonstrates how to authorize access into an AWS account from a specific branch and repository.

Remote and virtual repositories from Google Cloud Artifact Registry can help add assurance to your software supply chain.

How to migrate Pod Security Policies (PSPs) to the new format in the Kubernetes 1.21 release.

Google service account impersonation lets you run your terraform code and manage resources without overly broad access.

Private Service Connect offers secure, private connectivity to managed services, which are now accessible by hybrid networks and for global services.

Azure CNI Overlay assigns IP addresses from the user-defined overlay address space instead of using IP addresses from the VNET. It uses the routing of these private address spaces as a native virtual network feature. This means that cluster nodes do not need to perform any extra encapsulation to make the overlay container network work.

Microsoft introduced the public preview of the Istio add-on for Azure Kubernetes Service.