A configuration-based vulnerability hidden within thousands of applications using the AWS ALB authentication feature.   #attack   #aws

A guide to tools for auditing AWS IAM.   #aws   #iam

An extensive cloud extortion campaign leveraging exposed .env files of at least 110k domains to compromise organizations' AWS environments.   #attack   #aws

An opinionated, critical look at the state of security of vendor cloud integrations, along with recommendations for documenting and adhering to cloud security best practices for both vendors and customers.   #saas   #strategy

This research collected valid IAM role ARNs that live in random AWS accounts and subsequently tried to assume them.   #attack   #aws

A BGP-based feature of the AWS Direct Connect service allowed a third party to inject an incorrect route for an external IP assigned to an AWS customer, effectively hijacking their AWS-sourced traffic.   #attack   #aws

A phishing toolkit that runs serverless on Azure, based on Azure Functions to phish some Entra ID credentials and cookies.   #attack   #azure

The attack uses obfuscated LDAP requests to evade detection, leading to the execution of malicious scripts on compromised systems.   #attack   #saas

Some AWS mechanisms we can use to achieve more robust permissions on AWS: Organizations, SCPs, IAM Access Analyzer, permission boundaries, and more.   #aws   #explain   #iam

AWS ACM has a missing security boundary that allows users with AWS Signer permissions, but without ACM permissions, to sign code using any ACM certificate within the same account.   #attack   #aws

Two example IAM permissions boundary policies as a starting point for creating your own permissions boundary to meet the security needs of your organization.

AWS Attack Path Management Tool.

You can now check for the existence of an object before creating it.

Some of the key decisions involved in choosing between External Secrets Operator (ESO), Sealed Secrets, and ASCP for the Kubernetes Secrets Store Container Storage Interface (CSI) Driver, specifically for FSI customers with regulatory demands.

A solution that uses Amazon EventBridge, AWS Lambda, and Amazon S3 to copy scanned S3 objects to a destination S3 bucket.

This new capability helps to ensure that secret material cannot be erroneously deleted, either by accident or as part of an intended malicious attack.

An attacker with access to a vulnerable Microsoft Azure Kubernetes Services cluster could have escalated privileges and accessed credentials for services used by the cluster.

Required MFA for all Azure users will be rolled out in phases starting in the 2nd half of calendar year 2024 to provide our customers time to plan their implementation.