Security Newsletter - New Spectre-like attacks. Ransomware takes down pipeline. Minimal issue.
Dieter Van der StockMay 10
10
Monday May, 2021
Best of breed Sec Newsletters:
- TLDRsec.com from @clintgibler
- CloudSecList from @lancinimarco
- securitynewsletter.co from @dietervds
SRE Weekly Issue #269
Lex NevaMay 10
📖 [The CloudSecList] Issue 86
Marco from CloudSecListMay 09
[tl;dr sec] #82 - Supply Chain Security, Career Resources
Clint at tl;dr secMay 06
Introducing IAM Access Control for Apache Kafka on Amazon MSK
May 6
Today we announced AWS Identity and Access Management (IAM) Access Control for Amazon MSK. IAM Access Control is a security option offered at no additional cost that simplifies cluster authentication and Apache Kafka API authorization using IAM role or user policies to control access. By using IAM Access Control, customers …
Managed Streaming for Kafka - 4 updated methods
May 6
IAM Access Control for Amazon MSK enables you to create clusters that use IAM to authenticate clients and to allow or deny Apache Kafka actions for those clients.
Amazon Import/Export Snowball - 3 new 7 updated methods
May 6
AWS Snow Family adds APIs for ordering and managing Snow jobs with long term pricing
Amazon Simple Systems Manager (SSM) - 6 updated methods
May 6
SSM feature release - ChangeCalendar integration with StateManager.
Amazon Kinesis Analytics - 1 new 8 updated methods
May 5
Amazon Kinesis Analytics now supports RollbackApplication for Apache Flink applications to revert the application to the previous running version
How to monitor expirations of imported certificates in AWS Certificate Manager (ACM)
Dmitry KaganskyMay 7
Certificates are vital to maintaining trust and providing encryption to internal or external facing infrastructure and applications. AWS Certificate Manager (ACM) provides certificate services to any workload that requires them. Although ACM provides managed renewals that automatically renew certificates in most cases, there are exceptions, such as imported certs, where …
Nine additional AWS cloud service offerings authorized by DISA
Tyler HardingMay 6
I’m excited to share that the Defense Information Systems Agency (DISA) has authorized three additional Amazon Web Services (AWS) services at Impact Level (IL) 4 and IL 5 in the AWS GovCloud (US) Regions, as well as five additional AWS services and one feature at IL 6 in the AWS …
Use ACM Private CA for Amazon API Gateway Mutual TLS
Tracy PierceMay 5
Last year Amazon API Gateway announced certificate-based mutual Transport Layer Security (TLS) authentication. Mutual TLS (mTLS) authenticates the server to the client, and requests the client to send an X.509 certificate to prove its identity as well. This way, both parties are authenticated to each other. In a previous post, …
IAM makes it easier for you to manage permissions for AWS services accessing your resources
Ilya EpshteynMay 4
Amazon Web Services (AWS) customers are storing an unprecedented amount of data on AWS for a range of use cases, including data lakes and analytics, machine learning, and enterprise applications. Customers secure their data by implementing data security controls including identity and access management, network security, and encryption. For non-public, …
IAM 10th Anniversary: Top Recommendations for Working with IAM from Our AWS Heroes – Part 1 | Amazon Web Services
This year marks the 10th anniversary of AWS Identity and Access Management (IAM), which is essential in securing your applications and your AWS environment as …
rowan RT @jeffbarr: Top Recommendations for Working with IAM from Our #AWS Heroes: Part 1 - aws.amazon.com/blogs/apn/iam-… - More than a dozen tips from…
Michael Chan 🎂For #AWSIAM's 10th anniversary, we have #AWS Heroes this week as special guests presenting their recommendations for working with IAM. 1st guest is …
Top Recommendations for Working with IAM from Our AWS Heroes – Part 3: Permissions Boundaries and Conditions | Amazon Web Services
This is our third blog post celebrating AWS Identity and Access Management (IAM)‘s 10th anniversary. Explore two powerful ways that you can limit access to …
rowan This time it's my friend and yet another Ambassador, @iann0036 with the IAM celebration recommendations! 🎂 👯♂️ aws.amazon.com/blogs/apn/top-…
Michael Chan 🎉 Our next #AWS Hero for #AWSIAM's 10th anniversary week is @iann0036, who dives into a few ways you can limit access to resources in AWS! @AWSIdenti…
Kinnaird McQuade💥☁️ @kmcquade3
“We’ve recently upgraded our security, please create a new password”
No, you got hacked and don’t want to be honest about it 🙄
135
18May 10 · 3:46 PM
Brigid Johnson @bjohnso5y
🎂Y’all might have heard it’s IAM 10th Birthday. 🎂IAM is officially in the double digits. There are so many reasons to celebrate IAM on it’s special day. Here is my list. (1/11)
11421May 04 · 2:32 AM
Scott Piper @0xdabbad00
#awswishlist Stop using IAM user access keys in blog posts.
AWS Blogs @AWSBlogs
New Developer post by iliana etaoin:
A New AWS SDK for Rust – Alpha Launch
aws.amazon.com/blogs/develope…
10413May 07 · 11:53 PM
Ian Mckay @iann0036
New AWS architecture icons day 🧑🎨
Available at aws.amazon.com/architecture/i…
7618May 06 · 1:22 AM
Clint Gibler @clintgibler
🔥 New from @pdiscoveryio
🛠️Interactsh: Open source out-of-band testing tool
* Can emulate HTTP, DNS, & SMTP w/ wildcards enabled. Nuclei integration coming
blog.projectdiscovery.io/interactsh-rel…
🏃Exploiting Race conditions w/ @pdnuclei
blog.projectdiscovery.io/exploiting-rac…
#bugbountytips #WebSecurity
6521May 04 · 5:00 PM
Jim Scharf @jim_scharf
Happy 10th birthday, AWS IAM! Thanks to all of the team members over the years that contributed, and thanks to all of the AWS customers who have used it and provided feedback! aws.amazon.com/blogs/aws/happ… @AWSIdentity Looking forward to the next 10...
5813May 03 · 6:55 PM
Matt Fuller @matthewdfuller
A few wks ago I started researching all the ways data can be shared between AWS accts as part of a post I'm writing. 2 wks later and I'm still discovering new ways. Suffice it to say - the security "boundary" that #AWS accounts offer is ridiculous easy to break. #cloud #security
407May 09 · 8:56 PM Jim Scharf @jim_scharf
Ten years ago, AWS Identity and Access Management (IAM) was born. Reflections on what's changed in the last decade: linkedin.com/pulse/decade-s… @AWSIdentity
389May 03 · 7:13 PM Scott Piper @0xdabbad00
The existence of aws:PrincipalIsAWSService, aws:ViaAWSService, aws:CalledVia, and related condition keys is chaos.
AWS Blog Unofficial. @AWSBlogUnreal
The AWS Security, Identity & Compliance Blog #AWSSecurity
aws.amazon.com/blogs/security…
By: Ilya Epshteyn and Harsha Sharma
366May 04 · 6:32 PM Clint Gibler @clintgibler
Moar Dependency Confusion Resources 🧵
⚒️ DazedAndConfused: helps determine your exposure
Currently works on 12+ types of dependency files (more than any other tool I've seen)
Also has support for scanning GitHub and GitLab servers
github.com/salesforce/Daz…
2813May 05 · 5:00 PM
Big Data encryption or other security tools in the cloud
What tools do companies use for Big Data protection in the cloud? We want securely collect, aggregate and analyze (using Apache Spark) text files and video streams from our end users. What is the best way to protect their data without degrading cloud speed? Do any tools enable arbitrary access, …
- 🖊️ This newsletter was fwd to you? Subscribe here
- 💌 Want to suggest new content: contact me or reply to this email
- ⚡️ Powered by Mailbrew