A curated list of resources about detecting threats and defending Kubernetes systems.   #kubernetes   #monitor

Why the "iam.serviceAccounts.signBlob" permission can cause trouble in your GCP environment.   #attack   #gcp

This blog lays out a new potential post-exploitation technique: Abusing AWS Systems Manager (SSM) agent so that it functions as a Remote Access Trojan (RAT) on both Linux and Windows machines, while using an attacker AWS account as a Command and Control (C&C).   #attack   #aws

An overview of the possible aspects that should be reviewed when dealing with a Kubernetes Security Assessment.   #defend   #kubernetes

How to build and implement a Detection-as-Code pipeline from scratch using Terraform, Sumo Logic, and Tines.   #build   #monitor

Post providing an overview about some aspects and features which are important in delegating management of Workload ID in Microsoft Entra: Who can see and create apps? Why you should avoid assigning owners to service principals or application objects?   #azure   #explain   #iam

The article provides best practices for organizations and teams using GitHub Enterprise Cloud, including tips for securing repositories, managing access controls, and integrating with other security tools.   #ci/cd   #defend

A few guidelines that can help organizations mature their use of HashiCorp Terraform modules for scale and a faster release cadence.   #explain   #terraform

Okta has partnered with Google Chronicle to open source a set of detections rules that help surface cloud attack vectors and provide high-fidelity, contextualized alerts to give insight into potential threats. You can find these detections on GitHub.   #monitor   #saas

CNAPPgoat is an open source project designed to modularly provision vulnerable-by-design components in cloud environments. You can also refer to the companion blog post.

A textual GUI that allows to view and interact with your Terraform state.

DeRF (Detection Replay Framework) is an "Attacks As A Service" framework, allowing the emulation of offensive techniques and generation of repeatable detection samples in the cloud.

A fast stream-processing framework and daemon. You can also refer to the companion blog post.

An automated S3-compatible Bucket Inspector.

Activate Amazon Inspector within one or more AWS accounts, and be notified when a vulnerability is detected in an AWS Lambda function.

The enhanced vulnerability intelligence includes names of known malware kits used to exploit a vulnerability, mapping to MITRE ATT&CK framework, and evidence of public events associated with a vulnerability.

How to set up EventBridge to initiate SNS notifications for IAM configuration changes.

You can use AWS Resource Access Manager (AWS RAM) to securely, simply, and consistently share supported resource types within your organization or organizational units (OUs) and across AWS accounts.

Instructions for using Policy Simulator to see how a change to an organization policy impacts your organization.

Microsoft has been published a Token Theft playbook which includes investigation checklist, hunting queries, response/recovery task lists, and an accompanying decision tree.

Datadog is looking for an Engineering Manager for Cloud security to build and lead a talented team.

Lyft is looking for Security Engineers to join their Cloud Security team in Mexico City, Mexico.

Octopus Energy is looking for Cloud Security Engineer who is skilled in security architecture, deployment, and management.

TrustOnCloud is looking for a Cloud Security Researcher with a strong technical foundation in Cloud Security.

Deutsche Telekom is looking for people with experience with Cloud and Security to join them in Hungary.