This post provides recommendations for implementing an effective security monitoring strategy in AWS.   #aws   #monitor

Cloud automation isn't just about infrastructure anymore. This also affects automation language design.   #iac   #strategy

Some tricks @rhynorater picked up over the past 5 years of web app testing.   #attack   #aws

Another post looking at the perils of unproperly scoping access provided by OIDC.   #attack   #aws   #ci/cd

Apparently VSCode's secret manager allows any extension to extract all the secrets, including built-in authentication tokens for Microsoft and GitHub.   #attack

The AquaSec team found two misconfigurations in Kubernetes clusters belonging to more than 350 organizations openly accessible and largely unprotected.   #attack   #kubernetes

A researcher at Tenable has discovered an issue that enables limited, unauthorized access to cross-tenant applications and sensitive data (including but not limited to authentication secrets).   #attack   #azure

A write-up on a Browser-Powered Desync bug discovered in the Azure CDN service known as Front Door.   #attack   #azure

How to implement a mature Vault monitoring and observability strategy to simplify finding answers to important Vault questions.   #monitor   #vault

HashiCorp is changing its source code license from Mozilla Public License v2.0 (MPL 2.0) to the Business Source License (BSL, also known as BUSL) v1.1 on all future releases of HashiCorp products. HashiCorp APIs, SDKs, and almost all other libraries will remain MPL 2.0.   #announcement   #hashicorp

Noir is an attack surface detector form source code.

Tunneling over websocket protocol.

A Damn Vulnerable AWS Infrastructure.

Rego policies for enterprise-scale Compliance-as-Code with OPA Conftest.

Generative and mutative fuzzer for Kubernetes admission controller chains by automatically parsing the cluster api specification.

How to optimize your cloud-based SaaS design to reduce operating expenses, increase resiliency, and offer a high-performing experience for your customers.

Mountpoint for Amazon S3 is an open source file client that makes it easy for your file-aware Linux applications to connect directly to S3 buckets.

Amazon announced the public preview of AWS Backup logically air-gapped vault, a new type of vault that can be shared for recovery with other accounts using AWS Resource Access Manager (RAM).

Network Load Balancers (NLB) now supports security groups, enabling you to filter the traffic that your NLB accepts and forwards to your application.

The article discusses Cybershield, a new initiative by Google Cloud that aims to help governments collaborate and defend against cyber attacks.

New capabilities and services in Workforce Identity Federation can make it easier to manage your identity and access across multiple Google Cloud services.

New playbooks with tasks for BEC, Ransomware, and Phishing investigation.

Dropbox is looking for an experienced Security Engineering Manager to lead their Cloud Security team.

Block is looking for a senior engineer with an understanding of securing infrastructure and services in a cloud-native world.

Verkada is looking for a Sr. Staff Cloud Security Engineer in California.

Coalfire is looking for an Associate to support their Cloud Assurance team, assessing the security and compliance of client firms against regulatory and industry requirements and standards.