This article provides a comprehensive guide on Server-Side Request Forgery (SSRF) vulnerabilities, covering detection, exploitation techniques, and mitigation strategies. It explores advanced SSRF scenarios and offers practical examples for security professionals and developers.   #attack   #defend

This article warns about security risks in GitHub Actions reusable workflows. It demonstrates how attackers can exploit OIDC to access sensitive repository data, emphasizing the need for careful configuration and access control.   #attack   #ci/cd   #defend

How to turn email parsing discrepancies into access control bypasses and even RCE.   #attack

Post explaining how breaking Detection as Code down into functional areas (programming language, testing, integration & automation, and monitoring) can help assessing your current maturity and pinpoint areas for improvement.   #microsoft   #strategy

Streamlining the alert and detection flow of Security Information and Event Management system.   #monitor   #strategy

Options to identify, monitor and avoid persistent access on Managed Identities privileges by adding federated credentials on User-Assigned Managed Identities (UAMI) from malicious or unauthorized entities.   #azure   #defend

Google recommends organizations proactively disable their unauthenticated GKE read-only port 10255. Read more about why this is important and how to ensure all read-only ports are disabled.   #defend   #gcp   #kubernetes

Code auditing productivity multiplier.

Installation script to deploy standard software on Macs.

Container image to single executable compiler.

AWS honey token manager.

Kubectl plugin to print Kubernetes resource conditions.

Step-by-step instructions (with screenshots) on how to setup Google Workspace for your domains.

This article discusses AWS's approach to tracking and mitigating major cloud security threats.

Various ways Amazon Cognito user pools can enable multi-tenant identity for SaaS solutions.

How to use the Athena JDBC driver to connect to Athena from third-party SQL client tools.

Key considerations include maintaining consistent identities, staying compliant, reducing downtime and automating the process.

To make Kubernetes-driven compliance easier to manage, Google updated the CIS Google Kubernetes Engine benchmarks. Here's what's new.