This post explores the complexities of insecure-by-design vulnerabilities in cloud systems, which are inherent to the system's functionality and often overlooked.   #defend   #design   #strategy

By integrating automation and leveraging Large Language Models (LLMs), the Threat Detection and Response (TDR) team at Mercari reduced manual effort and increased the speed and accuracy of their responses.   #defend   #monitor   #process

How threat actors can exploit sensitive data stored in serverless environment variables in AWS, Azure, GCP and Kubernetes, and the use of cloud-offensive tools for this purpose.   #attack   #aws   #azure   #gcp   #kubernetes

A post from the Elastic team exploring AWS STS AssumeRoot, its risks, detection strategies, and practical scenarios to secure against privilege escalation and account compromise.   #aws   #elastic   #monitor

A cloud attack targeting Amazon SES, persistence, and a malicious AWS account ID.   #attack   #aws

This article discusses log poisoning attacks against Microsoft Sentinel, explaining how attackers can manipulate logs to evade detection. It covers attack techniques, potential impacts, and mitigation strategies for defenders to protect their SIEM environments.   #azure   #monitor

Microsoft Azure allows Windows Virtual Machines to join an Entra tenant that differs from the hosting tenant, using an Azure AD VM Extension for domain joining.   #attack   #azure

A tool for preventing the installation of malicious PyPI and npm packages. You can also refer to the companion blog post.

This terraform provider can be used to get remote code execution by injecting a dummy resource in a writeable state file.

Access, a centralized portal for employees to transparently discover, request, and manage their access for all internal systems needed to do their jobs.

Vanir is a source code-based static analysis tool that automatically identifies the list of missing security patches in the target system. You can also refer to the companion blog post.

35 more Semgrep rules from Trail of Bits. You can also refer to the companion blog post.

Geographic IP Filtering is a new feature of Network Firewall that you can use to filter traffic based on geographic location and meet compliance requirements.

These policies are a set of new optional controls that help you consistently enforce the desired configuration for a service.

AWS Config added support for a service-linked recorder, a new type of AWS Config recorder that is managed by an AWS service and can record configuration data on service-specific resources, such as the new Amazon CloudWatch telemetry configurations audit.

Post detailing the concepts, processes, and steps to get started with policy as code (PaC) and adopt this into your software development lifecycle.

Commerzbank has adopted Google Cloud's Custom Org Policies to enhance security for its Cloud Run environments, addressing the critical need for robust security in financial services.

Administrators can use custom organization policies to set granular resource configurations in order to enhance security posture, address regulatory requirements, and increase operational efficiencies, all without impacting development velocity.