Security Newsletter - Long list of breaches. Some important vulnerabilities.
Dieter Van der StockMar 29
29
Monday March, 2021
AWS Security Hub integrates with Amazon Macie to automatically ingest sensitive data findings for improved centralized security posture management
aws.amazon.comMar 25
AWS Security Hub is now integrated with Amazon Macie to automatically ingest sensitive data findings from Macie. Security Hub previously ingested policy findings from Macie, and this integration adds sensitive data findings. All of Security Hub’s findings are automatically normalized using the AWS Security Finding Format (ASFF), enabling you to …
How to automate SCAP testing with AWS Systems Manager and Security Hub
John TrollingerMar 24
US federal government agencies use the National Institute of Standards and Technology (NIST) framework to provide security and compliance guidance for their IT systems. The US Department of Defense (DoD) also requires its IT systems to follow the Security Technical Implementation Guides (STIGs) produced by the Defense Information Systems Agency …
How to implement the principle of least privilege with CloudFormation StackSets
Joel KnightMar 23
March 24, 2021: We’ve corrected errors in the policy statements in steps 2 and 3 of the section “To create the IAM policy document.” AWS CloudFormation is a service that lets you create a collection of related Amazon Web Services and third-party resources and provision them in an orderly and …
Christophe @christophetd
"Yesterday (2021-03-28), two malicious commits were pushed to the php-src repo [...]. We don't yet know how
exactly this happened, but everything points towards a compromise of the git.php.net server"
👀
news-web.php.net/php.internals/…
203
151Mar 29 · 11:57 AM
Scott Piper @0xdabbad00
Uh, there is no Cloudtrail record of AWS applying this policy! 🤬 I know it was applied because it did break a workflow (this key was used by a level of flaws.cloud, no errors a few days ago, then access denieds). If you add a policy to my IAM user, please log it AWS.
Scott Piper @0xdabbad00
AWS has started adding an inline policy to deny s3:* on compromised access keys in addition to their quarantine policy which is more focused on stopping bitcoin miners. This has the potential for greater customer impact but exfil is what companies tend to be more concerned about.
6718Mar 26 · 7:13 PM
Chris Farris @jcfarris
I kept telling you all these complex container things were gonna cause a problem. But no. Ya'll wanted to put k8s on your resume. Well now the Suez Canal is blocked. Good job.
6612Mar 23 · 11:57 PM Scott Piper @0xdabbad00
I checked the account and saw the new policy, and the access denieds on s3:ListBuckets calls, but I have no CloudTrail record of this policy being attached. So AWS can make IAM changes to my account without any audit record. This does not make me feel good.
5119Mar 26 · 7:21 PM
Clint Gibler @clintgibler
🗒️ awesome-k8s-security by @magnologan
Great list of resources including:
💊 The Basics
💼 Official Pages
📹 Talks and Videos
📰 Blogs and Articles
📗 Books
📆 Certifications
🔥 CVEs
📑 Slides
🧪 Trainings
🐾 Repositories
📂 Papers
github.com/magnologan/awe…
5213Mar 24 · 6:00 PM Clint Gibler @clintgibler
☁️ Terraformer
Yo dawg, I heard you like Infra *as* Code
But what about Infra to ➡️ Code?
Terraformer generates tf/json and tfstate from your *existing* infra
Supports a number of resources and services at:
* AWS
* GCP
* Azure
* & more! 🚀
github.com/GoogleCloudPla…
5411Mar 24 · 4:00 PM
rowan @elrowan
Always happy to see more data events in #AWS CloudTrail: This time it's DDB aws.amazon.com/blogs/database…
359Mar 24 · 9:56 PM rowan @elrowan
Haven't a chance to test, but I didn't realise that "Deny" at the Group level don't override "Allow" permissions at other levels (e.g. User) blog.lightspin.io/aws-iam-groups…
Just another reason NOT to use #AWS IAM Users. If you have to, make them assume a role ASAP...
297Mar 26 · 1:53 AM
Jim Scharf @jim_scharf
This is big. Literally (some customers do millions of requests per second).
rowan @elrowan
Always happy to see more data events in #AWS CloudTrail: This time it's DDB aws.amazon.com/blogs/database…
205Mar 24 · 10:04 PM Christophe @christophetd
Come discuss Infrastructure as code scanning with us on Sunday!
owasp @owasp
Join us @Owasp_DevSlop on Sunday 28th March: @christophetd will discuss shifting cloud security left and scanning IAC for security issues #cloudsecurity #shiftleft . 🔗: addevent.com/event/rJ6187568
184Mar 23 · 6:14 AM
New Console experience... rant.
Dear AWS,
Please stop telling us about the new experience console, when there is so many problems with it. First of all you need to update all your DOCUMENTATION for the new console. Your "howtos" don't match the new console. Secondly, and most important, make sure the new console has …
Can someone put Cloud Security in Newbie terms?
I’m soon to be starting a career in Cloud and want to know more about cloud security. Cybersecurity was my career of choice and I’d love to see how to merge that with my interest in cloud. Can someone explain what cloud security means? How do companies and people secure …
- 🖊️ This newsletter was fwd to you? Subscribe here
- 💌 Want to suggest new content: contact me or reply to this email
- ⚡️ Powered by Mailbrew