|
🔗 From the web |
|
|
|
AWS security assessment: what scanners are missing and how threat modeling may help you? |
|
|
There are many tools available today that are designed to automate security checks. But some people rely too much on tools, as if conducting an AWS security assessment is the same as formatting the scanner’s output into fancy-looking report. This blog post focuses on what scanners are missing and why tools cannot fully replace the assessor. |
|
|
|
|
|
|
SLSA dip — At the Source of the problem! ✅ |
|
|
This article is part of a series about the security of the software supply chain. Each article will be analyzing a component of the Supply chain Levels for Software Artifacts (SLSA) model in depth, from the developer’s workstation all the way to the consumer side of the chain. |
|
|
|
|
|
|
How to implement DevSecOps in a Kubernetes cluster environment-Github Actions and Azure DevOps |
|
|
Using Kube-bench (checks performed to determine Kubernetes is deployed securely) and Kubescape (an open source tool that includes risk analysis, security compliance, RBAC visualizer, and image vulnerabilities scanning) integrated in Github Actions. |
|
|
|
|
|
|
How Mitiga Found PII in Exposed Amazon RDS Snapshots |
|
|
A recent Mitiga Research Team investigation found the well-regarded Amazon Relational Database Service is leaking PII via exposed RDS Snapshots. |
|
|
|
|
|
|
AWS IAM Roles, a tale of unnecessary complexity |
|
|
IAM was designed to manage authentication and authorization in a single AWS account. As adoption of the cloud grew, organizations started to identify the need for using multiple AWS accounts. Instead of refactoring the architecture, AWS did what AWS does best - it built a new service. |
|
|
|
|
|