Mercari sharing their experiences with creating a system to map the company's attack surface, discussing the difference between internal and external perspectives, as well as the pitfalls of relying on IaC.   #defend   #strategy

The SAML spec is an absolute beast. We've each read it multiple times. Here's a simpler explanation.   #explain   #iam

You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way.   #attack   #ci/cd

Snyk's research into Repo Jacking has shown the current measures provided by SCM providers are not always sufficient, and that the implications of abusing the way certain providers handle renaming organizations can result in significant problems for third-party ecosystems that rely upon SCM-hosted artifacts.   #attack   #ci/cd

Organizations that have used GCP's Cloud Functions could be impacted by a privilege escalation vulnerability discovered by Tenable and dubbed as ConfusedFunction.   #attack   #gcp

How a self-sign-up user could utilize an ETL platform to spawn a botnet and launch a DDoS attack against anyone.   #attack   #saas

A forensic analysis of Azure Run Command activities, focusing on how to detect and investigate potential misuse.   #azure   #monitor

A tool to conduct preliminary security check as early as possible within your development process.

A community-owned library of policies for the OPA Gatekeeper project.

A GitHub Action that adds opinionated comments to a PR from Terraform fmt/init/plan output.

The Secrets Manager Agent is a client-side agent that allows you to standardize consumption of secrets from Secrets Manager across your AWS compute environments.

Some sketchnotes on Zero Trust and BeyondCorp Google Cloud.

VPC Service Controls (VPC-SC) creates isolation perimeters around cloud resources and networks in Google Cloud, helping you limit access to your sensitive data.