⚪️ Introducing CAS: Securing applications with private CAs and certificates

Google announced Certificate Authority Service (CAS), a highly scalable and available service that simplifies and automates the management and deployment of private CAs.

https://cloud.google.com/blog/products/identity-security/introducing-cas-a-cloud-based-managed-ca-for-the-devops-and-iot-world

#gcp

🔸Best Practices for Securing Amazon EMR

This post walks you through some of the principles of Amazon EMR (a managed Hadoop framework) security, including encryption, authentication, and network access.

https://aws.amazon.com/blogs/big-data/best-practices-for-securing-amazon-emr/

#aws

🔸Analyzing IAM Policies at Scale with Parliament

The most efficient and repeatable method for finding misconfigurations in IAM policies and roles is to automate the detection process using existing libraries. This blog explores how the Parliament library can be run to detect if a policy is malformed, identify unknown permissions that do not exist within the platform, and callout resource mismatches when resources and permissions do not apply to each other.

https://blog.scalesec.com/analyzing-iam-policies-at-scale-with-parliament-69ae50d335e

#aws

🔸cr0hn/festin

A tool by Daniel García for discovering open S3 Buckets starting from domains. Collects info via DNS, web pages (crawler), and S3 buckets themselves (like S3 redirections). “Watch mode” can listen for new domains in real time, and supports downloading bucket objects and putting them in Redis Search to enable full-text search of discovered contents.

https://github.com/cr0hn/festin

#aws

🔸SmogCloud: Expose Yourself Without Insecurity - Cloud Breach Patterns

BlackHat Arsenal presentation by Bishop Fox’s Rob Ragan and Oscar Salazar on a new tool: Smogcloud, that can be used to find exposed AWS cloud assets that you may not have known you had.

- For example: Internet-facing FQDNs and IPs across one or hundreds of AWS accounts, assets that are no longer in use, services not currently monitored, shadow IT, etc.
- Currently supports about 13 different AWS services.

https://github.com/BishopFox/smogcloud

#aws

⚪️Compromise any GCP Org Via Cloud API Lateral Movement and Privilege Escalation

Great BlackHat USA / DEF CON Safe Mode talk by Allison Donovan and Dylan Ayrey and tool release, gcploit, a “BFS search tool meant for defensive threat models, a mock org simulator, as well as stack driver queries that profile the gcploit tool.”

https://www.youtube.com/watch?v=Ml09R38jpok

#gcp

🔸How to Create Unlimited Rotating IP Addresses with AWS

Devin Stokes describes how to use proxycannon-ng to distribute your traffic over an endless supply of cloud-based IP addresses.

https://medium.com/@devinjaystokes/using-proxycannon-ng-to-create-unlimited-rotating-proxies-fccffa70a728

#aws

🔸Abusing AWS Connection Tracking

How to abuse Connection Tracking in AWS to persist connections on a host, even when a more restrictive security group is put in place as a result of incident response.

https://frichetten.com/blog/abusing-aws-connection-tracking/

#aws

🔸Using Splunk to Detect Abuse of AWS Permanent and Temporary Credentials

How to detect if an attacker is abusing temporary credentials in your AWS accounts using Splunk.

https://www.splunk.com/en_us/blog/security/using-splunk-to-detect-abuse-of-aws-permanent-and-temporary-credentials.html

#aws

⚪️ Google Cloud security best practices center

Best practices providing specific, informed guidance on helping secure Google Cloud deployments and describing recommended configurations, architectures, suggested settings, and other operational advice.

https://cloud.google.com/security/best-practices

#gcp

🔸AWS Auto Remediate

Open source application to instantly remediate common security issues through the use of AWS Config.

https://github.com/servian/aws-auto-remediate

#aws

🔹GitHub Action for Azure Policy Compliance Scan

It is now possible to trigger on-demand Azure policy compliance evaluations from GitHub workflows.

https://github.com/marketplace/actions/azure-policy-compliance-scan

#azure

🔸Anatomy of AWS Lambda

Article taking a closer look on the anatomy of the AWS Lambda functions and the processes that are happening below the surface. If you are not super-familiar with Lambda, I highly recommend this post which provides a very well-thought introduction.

https://dev.to/sosnowski/anatomy-of-aws-lambda-1i1e

#aws

🔹🔸⚪️Cloudkeeper - Housekeeping for Clouds

Cloudkeeper is a standalone CLI tool that periodically collects a list of resources in cloud accounts, provides metrics about them, and can clean them up.

https://github.com/mesosphere/cloudkeeper

#aws #gcp #azure

🔸Automate Amazon Athena queries for PCI DSS log review using AWS Lambda

How to use AWS Lambda to automate PCI DSS (v3.2.1) evidence generation, and daily log review to assist with your ongoing PCI DSS activities.

https://aws.amazon.com/ru/blogs/security/automate-amazon-athena-queries-for-pci-dss-log-review-using-aws-lambda/

#aws

🔹Cyber Security on Azure

Cyber Security on Azure explains how this 'security as a service' (SECaaS) business solution can help you better manage security risk and enable data security control using encryption options such as Advanced Encryption Standard (AES) cryptography. Discover best practices to support network security groups, web application firewalls, and database auditing for threat protection. Configure custom security notifications of potential cyberattack vectors to prevent unauthorized access by hackers, hacktivists, and industrial spies.

#azure #literature

🔸Securing resource tags used for authorization using a service control policy in AWS Organizations

How you can use attribute-based access controls (ABAC) in AWS to help provision simple, maintainable access controls to different projects, teams, and workloads as your organization grows.

https://aws.amazon.com/ru/blogs/security/securing-resource-tags-used-for-authorization-using-service-control-policy-in-aws-organizations/

#aws

🔸Certificate Authority now supports Private CA sharing

AWS Certificate Manager (ACM) Private Certificate Authority (CA) now supports sharing a Private CA with any AWS account or within your organization. This eliminates the need to provision duplicate resources in every account in a multi-account environment, reducing the cost and complexity of managing those resources in every account.

https://aws.amazon.com/ru/about-aws/whats-new/2020/08/aws-certificate-manager-private-certificate-authority-supports-private-ca-sharing/

#aws

🔷Attacking Azure & Azure AD, Part II

New post on attacking AzureAD Service Principals, Intune, and documenting an Azure Logic App primitive. Also introducing the complete re-write of PowerZure.

https://posts.specterops.io/attacking-azure-azure-ad-part-ii-5f336f36697d

#azure

🔸spacesiren/spacesiren

A honey token manager and alert system for AWS. With this fully serverless application, you can create and manage honey tokens at scale – up to 10,000 per SpaceSiren instance – at close to no cost… It provides an API to create no-permission AWS IAM users and access keys for those users.

https://github.com/spacesiren/spacesiren

#aws