Cloud security @ ScaleSec
Joined June 2008
- Tweets92
- Following576
- Followers92
- Likes835
Steven Smiley retweeted
Create AWS access keys that can be placed in various places to tempt bad guys. If used, you will be notified within ~4 minutes. You can then investigate that asset to determine if it may have been compromised.
buff.ly/4fKBGgM
Steven Smiley retweeted
🍯 aws-mine: An open source AWS honey token manager
Catch attackers & compromised assets with decoy AWS access keys
Notifies users via Amazon SNS within ~4 minutes when keys are used
By @StevenSmiley
github.com/StevenSmiley/aws-…
#cybersecurity
Steven Smiley retweeted
📖 CloudSecList Issue 175 just got released, w/ content from @scalesec @frichette_n @__steele @TrustedSec @permisosecurity @praetorianlabs and more! cloudseclist.com/issues/issu…
![📖 [The CloudSecList] Issue 175](https://pbs.twimg.com/card_img/2111879608882561024/X69ff9ro?format=png&name=280x280_2)
Steven Smiley retweeted
This was a massive undertaking but I'm so excited to share our findings with the #AWS cloud #security community. Special thanks to @christophetd for the great work here.
We are proud to release Datadog's first security study: "The State of AWS Security - A Look Into Real-World AWS Environments"
Read the report to learn about key mechanisms to secure AWS environments and how organizations worldwide are implementing them. dtdg.co/state-of-aws-cloud-s…
Good data driven analysis from Datadog on AWS security. No surprises for those of us in cloud security but we need to get better at closing these gaps.
We are proud to release Datadog's first security study: "The State of AWS Security - A Look Into Real-World AWS Environments"
Read the report to learn about key mechanisms to secure AWS environments and how organizations worldwide are implementing them. dtdg.co/state-of-aws-cloud-s…
Steven Smiley retweeted
AWS announces updated Support Plans Console with new IAM controls
AWS Support continues to provide a mix of tools, technology, people, and programs to help you optimize performance, lower costs, and innovate faster. Today, the new AWS Support Plans... aws.amazon.com/about-aws/wha…
Steven Smiley retweeted
📺 fwd:cloudsec 2022
Recordings are live!
Tons of great #cloudsecurity talks
H/T @0xdabbad00, @fwdcloudsec
youtube.com/playlist?list=PL…
Steven Smiley retweeted
New Security, Identity & Compliance post by Faraz Angabini:
Extend AWS IAM roles to workloads outside of AWS with IAM Roles Anywhere
aws.amazon.com/blogs/securit…
Steven Smiley retweeted
If the goal of incident analysis is blame (vs. understanding why an event happened so recurrence can be prevented) then analysis will stop as soon as the first blamable cause is found as opposed to the true root cause.
Hence, blameless postmortems are crucial.
Steven Smiley retweeted
you'll want to check these out if you haven't yet: aws.amazon.com/blogs/securit…
aws-preview.aka.amazon.com/b…
Steven Smiley retweeted
Take a layered approach to #cloudsecurity with code-specific protections.
#Cloud #awslambda #aws #awssecurity #securecoding #lambda #defenseindepth #applicationsecurity #DevOps
scalesec.com/blog/implementi…
Steven Smiley retweeted
Historically the one thing that completely revolutionised my developer experience was: Smalltalk.
But the most recent major shift for me has been starting to use the AWS CDK youtu.be/AYYTrDaEwLs
This Post is from an account that no longer exists. Learn more
Steven Smiley retweeted
📖 CloudSecList Issue 138 just got released, w/ content from @ScaleSec @mattklein123 @isovalent and more! cloudseclist.com/issues/issu…
Steven Smiley retweeted
Defense in Depth
The goal of defense in depth is not just multiple layers of controls to collectively mitigate one or more risks, but rather multiple layers of inter-locking or inter-linked controls.
philvenables.com/post/defens…
Steven Smiley retweeted
The tables in this blog post are very powerful for understanding when to use different controls and conditions keys. Awesome work by @IlyaEpshteyn
Our new condition keys allow you to limit your principals’ access to include only resources belonging to a specific AWS account, AWS organization, or OU.
Learn how they can form part of a wider security strategy to create a perimeter around your data. 👇 go.aws/3w1KcDi
Steven Smiley retweeted
☁️ Mitigating the top 10 security threats to GCP using the new CIS Benchmark
* Resource segregation
* IAM
* Network security
* Cloud storage
* Compute engine
* Cloud SQL
* Logging & monitoring
By @NCCGroupInfosec's @wucpi
research.nccgroup.com/2022/0…
Steven Smiley retweeted
Seriously pay attention to this... "Today, my Administration is reiterating those warnings based on evolving intelligence that the Russian Government is exploring options for potential cyberattacks." 🧵 whitehouse.gov/briefing-room…
Steven Smiley retweeted
Lots of scoffing this morning at the notion that DoD could keep Russian jets grounded with cyber attacks. It might seem like magic, but it's completely plausible. Cyberattacks against military weapon systems are not "mythical." vox.com/policy-and-politics/… 1/N
Steven Smiley retweeted
#Russia has been gaining access to US critical infrastructure for years. If you manage critical transportation infrastructure, here are some immediate steps you should be taking to protect yourself from cyberattack: ✈️🚂⛴ 1/n