A collection of API key rotation tutorials for AWS, GCP, GitHub , and more.   #aws   #azure   #ci/cd   #defend   #gcp

Guide exploring the best practices for securing GitHub and GitLab, covering topics that include user authentication, access control, permissions, monitoring, and logging.   #ci/cd   #defend

Retool experienced a security breach due to a spear phishing attack in August 2023. Attackers used social engineering tactics, compromising an employee's Google Authenticator, which exposed multi-factor authentication (MFA) codes.   #attack   #saas

The Sysdig Threat Research Team (TRT) has uncovered a novel cloud-native cryptojacking operation which they've named AMBERSQUID. This operation leverages AWS services not commonly used by attackers, such as AWS Amplify, AWS Fargate, and Amazon SageMaker.   #attack   #aws

A deep dive into the recent MGM breach and some insights into the actor behind the attack and possible mitigations.   #attack   #iam   #saas

Wiz Research found a data exposure incident on Microsoft's AI GitHub repository, including over 30,000 internal Microsoft Teams messages - all caused by one misconfigured SAS token.   #attack   #azure

The Trail of Bits team identified 10 security vulnerabilities within the caddy-security plugin for the Caddy web server that could enable a variety of high-severity attacks in web applications, including client-side code execution, OAuth replay attacks, and unauthorized access to resources.   #attack

Post discussing Azure Storage Accounts, pointing out forensic artifacts in Azure that can help investigate ransomware attacks, and offering methods for attack detection.   #attack   #azure   #defend

When an owner initiates a session and performs actions like gcloud auth login, the session state persists, shared across multiple users accessing the workstation through the same URL. This means that any user with access to the workstation can view and interact with the session artifacts created by the owner.   #attack   #gcp

All GitHub.com users can now register a passkey to sign in without a password.   #announcement   #ci/cd

Iamlive, which generates least privilege roles by intercepting network calls to your cloud environment, now supports also Azure and GCP.

A collection of authentication Go packages related to OIDC, JWKs, Distributed Claims, LDAP.

Container image linter for security.

PMV is a tiny utility for working with the 1password CLI.

A repository providing sample templates for security playbooks against various scenarios when using AWS.

Post covering roles and entitlements, how they are applicable in apps authorization decisions, how customers implement roles and authorization in their app today, and how to shift to a centralized PBAC model by using Amazon Verified Permissions.

How you can use PKCS #11-compatible cryptographic modules, such as YubiKey 5 Series and Thales ID smart cards, with your on-premises servers to securely store private keys.

Chronicle's latest update unifies our SOAR and SIEM solutions, integrates Mandiant's attack surface management technology, and offers more robust application of threat intelligence.

New PSC interfaces allow a service producer to access a consumer's network, while maintaining the separation of producer and consumer roles.

The open-source Community Security Analytics (CSA) provides pre-built queries and reports you can use on top of Log Analytics powered by BigQuery.

Terraform Cloud workspaces integrate with Workload Identity Federation to authenticate and then impersonate Google Cloud service accounts.

When you enable managed identity authentication in Logic App and grant it permissions in Log Analytics workspace or Application Insights component, you can query data without needing to provide credentials, secrets, or Azure AD tokens, for Azure Monitor Logs connector authentication.

How to enable GitHub Advanced Security for Azure DevOps code scanning, secret scanning, and dependency scanning in Azure DevOps and connect to Microsoft Defender for Cloud.

The Threat Detection and Response team (TDR) at Airbnb is focused on automating security detection, responding to security incidents, and working with partner teams to build capabilities that support the incident lifecycle.

Snowflake is looking for experts in cloud security architecture and operations who can help them maintain highly defensible cloud infrastructure, and follow SecDevOps best practices to reduce toil for their team and their internal customers.

The role requires expertise in cloud security, containerization, and Kubernetes, and involves designing and implementing security solutions.