Palantir went passwordless across their company, including corporate and production environments. They documented their journey: part 1, part 2.   #defend   #strategy

To prevent abuse against the use of Snapshot Creation, Instance Creation and Instance Deletion features within cloud environments, security teams and cyber-defenders must ensure that proper monitoring and logging services are enabled across all cloud providers they utilize.   #aws   #azure   #defend

It's difficult to unconditionally recommend Symmetric key JWTs today, given the current state of documentation and the overwhelming evidence that developers copy/paste default symmetric keys.   #build

AWS Security Hub is an awesome tool for creating a native, organization-wide security feed. Learn how to set it up right from the start, for the lowest cost.   #aws   #build   #monitor

A cheatsheet for analyzing AWS cloud incidents using CloudTrail with AWS Athena.   #aws   #explain   #monitor

An experiment in build a solution to eliminate the toil involved in detection engineering, going from a threat idea to a finished detection or analytic.   #build   #monitor

How to use HashiCorp Vault as a trusted CA for issuing temporal code signing certificates within a GitHub Actions workflow.   #ci/cd   #vault

Using DuckDB to query Cloud Provider audit logs when you don't have a SIEM available.   #aws   #monitor

AWS Controllers for Kubernetes (ACK) lets you define and use AWS service resources directly from Kubernetes.

Kubernetes tail. Streams logs from all containers of all matched pods.

Aan application that temporarily assigns Google Cloud IAM Roles and includes an approval process.

ZAP introduced a new add-on designed to streamline the process of testing gRPC endpoints and handling Protobuf messages.

Some common approaches for collecting data from multiple AWS services across your organization, including common patterns with code samples that you can reuse to consume the data.

How to implement a modified alternating-user solution that uses Amazon RDS admin user credentials to rotate database credentials while not creating an identical _clone user.

Bitbucket Secured Variables can be leaked in your pipeline and expose you to security breaches.

To provide built-in and centralized visibility into your applications, GCP is introducing software supply chain security insights for GKE workloads in the GKE Security Posture dashboard.

Increase your security posture and receive an analysis of the top Azure WAF rules triggered, top offending IPs in the environment, SQL injection and Cross-site scripting attacks blocked by WAF, along with natural language explanation of the analysis.