VALUABLE RESOURCES AND STRATEGIES REVEALED BY THE TOP INFOSEC CONSULTING ENTREPRENEURSHIP EXPERTS IN THE WORLD Ted Demopoulos, author of the popular go to book Infosec Rockstar, has put together a FREE online event (http://bit.ly/InfoSecConsultCon) that brings together the best Infosec consulting and entrepreneurship experts in the industry to teach you… Continue reading
Ever want to visit a website but don’t trust it enough to use your personal/work computer? What you need is a temporary system that is totally isolated from anything sensitive. Why not use a cloud-based virtual machine, such as offered by Amazon Web Services Elastic Compute Cloud? Here is how… Continue reading
Amazon Web Services has made it easy to implement encryption-at-rest for S3 buckets, but older S3 buckets may have predated this feature enhancement. If you have a large number of buckets, this could be a tedious thing to check via the console. Here is a simple one-liner to check all… Continue reading
Last week (9/7/2017), Equifax announced that on July 29 they discovered that an exploited web application vulnerability was being used to access a trove of consumer information for the previous 2 ½ months, until discovery. Various news outlets, such as the New York Post are starting to report that the… Continue reading
Sharing this slide because it illustrates the business value of integrating application security testing at the front of the Systems Development Life Cycle. (Slide courtesy of Veracode, Inc.)
From a compliance perspective, organizations need to have a hardening standard derived from an authoritative source with solid engineering-based reasons of why we depart from any of the recommendations. Most organizations use the Center for Internet Security (CIS) Hardening Benchmarks because that choice is easy to defend. The CIS benchmarks… Continue reading
The following excerpt is a thread from a discussion on Linkedin in the Information Security Community group. Question: How can a young professional convince startups that InfoSec is needed? And then get them to hire him? I am currently studying InfoSec Management and I am looking to get a job… Continue reading
When working on Linux it is often very helpful to review the commands that you have entered. For example, you may want to paste some of the commands into a script or may want to recreate the steps to solve the problem you were working on. Here is how I… Continue reading
No, not exactly. The SHA-1 hashing algorithm still does what it is supposed to do. SHA-1 creates an unpredictable 20 byte “fingerprint” of the data input into the function, in this case a web server certificate. It is the unpredictability of the output that makes cryptographic hash functions so useful. … Continue reading
The US Federal Government requires that its agencies protect sensitive, but unclassified information using cryptographic modules that have been validated to Federal Information Processing (FIPS) Standard 140-2 “Security Requirements for Cryptographic Modules.” This standard replaced its predecessor, FIPS 140-1. In this context, the term “validated” means tested by accredited testing… Continue reading
"Azure AD continues to handle more traffic over time (now at 500 million monthly active users generating tens of billions of authentications daily" https://office365itpros.com/2021/11/25/azure-ad-backup-authentication-service/
Cloudsplaining (scans AWS IAM policies for excessive permissions) now integrated with Checkov. You can just point Checkov at Terraform code to find policies with Privilege Escalation, Resource Exposure, Credentials Exfi, & Data Exfil capabilities. https://twitter.com/bridgecrewio/status/1462848730944712710
Check out today's post from @kmcquade3 and @BarakSchoster to learn how #Cloudsplaining and #Checkov can be used together to identify AWS IAM least privilege violations in both build-time and runtime. 🔎 https://bridge.dev/3cCFiCg
Good stuff https://blog.shiftleft.io/api-security-101-11fafcc4ba35
