I’m often asked what the biggest cyberthreats are in the cloud. When people pose that question, they seem to be expecting an answer on par with a Hollywood movie plot. The truth is far simpler. The number one threat in the cloud today is service misconfigurations. Despite the cloud’s clear operating model, teams continue to…
Read More
This week a new vulnerability was published (CVE-2019-5736) that highlights everything bad and good about containers. Simply put, this vulnerability can be exploited using an infected container to attack the host. It’s a real world example of a breakout attack that has long been a major concern in virtualized and container environment. Here, the attack…
Read More
Editors Node: This integration was created early in the product lifecycle of AWS Security Hub and was made available during the preview phase of the service. During the preview phase, this integration was tested in a number of scenarios with an assortment of customers. Based on those experiences, this integration has been retired as the team looks…
Read More
[Originally presented at the Gartner Security & Risk Management Summit 2018, “Security In A DevOps World” examines the challenges and benefits of integrating security technology and thinking into the development process at the early stages. The slides are designed to assist in the presentation of the material but they also might come in handy as a…
Read More
This week 40,000 people are going to gather in Las Vegas for the biggest event in cloud, AWS re:Invent 2017. This is a fantastic event jam packed with opportunities to meet members of the community, learn about great new services from AWS, and have a blast. I’ve already written about how to get the most…
Read More
It’s easy to get lost in a sea of marketing terms. Recently “Hybrid Cloud” has bubbled up more and more. The good news here is that the term is an accurate and useful way to describe the reality that most organizations are facing…and will continue to face for the foreseeable future. Unless you started your…
Read More
Google’s Next 2017 conference kicks off today with a series of bootcamps. The regular program starts on Wednesday and runs through Friday, highlighting the latest offerings in the Google Cloud. This is the third iteration of the conference and as with the Google Cloud itself, the show is going to be bigger and better than…
Read More
Our researchers produce a lot of really interesting material. This week, they published a paper called, “U.S. Cities Exposed In Shodan.” The research looks systems that are exposed online…exposure that systems owners aren’t always aware of. The most disturbed statistic in the research is a simple one: the fourth most exposed system is MySQL. I had…
Read More
One of the key benefits of the cloud is focus. Spinning up a virtual server in the cloud lets you focus on the operations and security of the operating system, you applications, and your data. Similarly migrating to a SaaS productivity suite lets you focus on your data and getting work done. This is the…
Read MoreIn San Francisco last week, AWS opened their summit series for 2014. 5000+ people packed into the Moscone Center, and there was a ton of energy in the air. I was fortunate enough to have the opportunity to attend and to speak. I presented, “Updating Security Operations for the Cloud,” which is the talk I’ve…
Read More
