There are vastly more engineers at Google dedicated to creating and maintaining new products than there are security engineers working to secure products. For this reason, Google security has to focus on operating at scale and find ways to make meaningful security improvements across Google's vast portfolio of services.   #strategy

Post shedding some light on known attack paths in an Azure environment.   #attack   #azure

Post outlining a Kubernetes security model and analyzing the threat landscape to provide security analysts with a better understanding of their organization's Kubernetes environment.   #defend   #kubernetes

Having a security-oriented scheduling strategy can help to reduce the overall risk of workload compromise in a comprehensive security design. If critical workloads are separated at the scheduling decision, the blast radius of a compromised pod is reduced.   #attack   #defend   #kubernetes

A bug in an internal GitHub API that allowed attackers to trick the internal API into signing commits as any user.   #attack   #ci/cd

A view on least privilege which proposes its application misleads us in a wrong sense of security.   #aws   #defend

The Orca Research Pod has discovered a risk in Google Kubernetes Engine (GKE) that would allow an attacker with any Google account to take over a Kubernetes cluster. You can also read the follow up blog post.   #attack   #gcp   #kubernetes

Collection of example Service Control Policies (SCPs) that are useful for sandbox and training AWS accounts.

Billing & Payments knowledge for cloud platforms.

A CLI tool to sign and verify artifacts.

Example policies demonstrating how to implement a data perimeter on AWS.

OCI hook to trace syscalls and generate a seccomp profile.

How you can use multiple Amazon Cognito user pools alongside Amazon Verified Permissions to build a single access layer to APIs.

By adopting AWS Control Tower Account Factory for Terraform, Zurich were able to achieve the scalability, resilience and performance to support provisioning of a projected 3000+ accounts.

The Azure Network Watcher Connectivity Check feature helps to drastically reduce the amount of time needed to find and detect connectivity issues in the infrastructure.