The NSA and CISA are releasing a cybersecurity information sheet to provide recommendations and best practices for improving defenses in cloud implementations of development, security, and operations (DevSecOps).   #ci/cd   #defend

How to reduce the privileges of AWS access keys in order to mitigate their risk.   #aws   #defend   #iam

A Better way to configure AWS Identity Center to use Google Workspace/Cloud Identity with SCIM Support.   #aws   #build   #gsuite

The process of verifying container image signatures and the benefits of implementing this practice in a Kubernetes environment.   #build   #kubernetes

Reduce the size of your Kubernetes containers to reduce security vulnerabilities CVE. Some tools to make this happen: Chainguard Apko and Melange, Buildpacks.io, WolfiOS.   #build   #containers   #kubernetes

The article discusses the importance of using Terraform lockfiles. It explains how lockfiles work, why they are necessary, and provides practical examples on how to use them effectively in Terraform projects.   #explain   #terraform

How to use Terraform "check" blocks and continuous validation with AWS, Google Cloud, and Azure services.   #aws   #azure   #defend   #gcp   #terraform

While doing research on Microsoft SQL (MSSQL) Server, a GoSecure ethical hacker found an unorthodox design choice that ultimately led to a web application firewall (WAF) bypass.   #attack   #aws

The Kubernetes Bill of Materials (KBOM) standard provides insight into container orchestration tools widely used across the industry.

Private Terraform Registry Manager.

A collection of "fake" Terraform modules designed to mimic AWS and GCP resources.

A series of tools to develop a comprehensive map from SDK calls to IAM actions, and evaluation of managed policies.

EarlyBird is a sensitive data detection tool capable of scanning source code repositories for clear text password violations, PII, outdated cryptography methods, key files and more.

GitHub token permissions Monitor and Advisor actions. You can also refer to the companion blog post.

Terraform modules that help to set up an OIDC integration between GitLab and GCP. You can also refer to the companion blog post.

A fully managed service that aggregates and normalizes security data across SaaS applications to improve observability and help reduce operational effort and cost with no integration work necessary.

Cybersecurity training with a plan that offers full access to the platform and all of its skills development content, including custom learning paths.

Google is killing the Security Command Center "assets" feature and recommends moving to Cloud Asset Inventory instead.

The interface is designed to streamline the security management of your GKE clusters, and now includes a range of powerful features such as misconfiguration detection and vulnerability scanning.

New and existing Google Cloud customers can migrate their sensitive data to the cloud with greater confidence thanks to the newly CDMC-certified architecture.

Azure Application Gateway now supports configuring the same port number for public and private listeners.

Azure NetApp Files now supports multiple encryption layers for increased data security.

Figma is hiring for Security Engineers in Corp Security, Abuse Prevention, Safe Components, and Consulting.

OpenAI is looking for a Security Engineer in London with experience in Detection & Response.

Dell is looking for a Security Engineer in Singapore with experience in Kubernetes and Docker.