Featured
2024
December 18, 2024
State of 'State of Cloud Security' Reports: Insights or Self-Owns?
Dozens of hours reading State of Cloud Security reports that I think miss the mark.
November 20, 2024
The First Security Hire Rule of Thumb
When should you hire that first security person?
October 07, 2024
Answering "Dumb Security Questionnaires"
Doing security well? Then here are some tricks for pushing through the security questionnaire quagmire.
September 19, 2024
🔗 [fwd:cloudsec] How to 10X Your Cloud Security (Without the Series D)
September 12, 2024
Scorecarding Security
A survey of approaches to scorecarding in security programs.
September 10, 2024
🔗 [Tracebit] The Security Canary Maturity Model
August 27, 2024
Industrial IAM Service Role Creation
A guide to tools for creating AWS IAM service roles.
August 13, 2024
🔗 [Tracebit] Canary Infrastructure vs. Real World TTPs
July 31, 2024
Poisoning the SSM Command Document Well
Responsibly disclosing risks in using SSM Command Docs for software distribution.
July 23, 2024
🔗 [CrowdAlert] Tips for SOCLess Oncall
July 16, 2024
🔗 [Tracebit] A hard look at GuardDuty shortcomings
July 12, 2024
Thwacking DDOS with AWS WAF
AWS WAF is definitely not the best DDOS prevention tech on the market. But if you're ever in the seat and it's the tool you have, here's your guide.
June 26, 2024
Publicly Exposed AWS SSM Command Documents
An analysis of the thousands of public SSM Command documents, including identification of secret leakage.
June 21, 2024
AWS OIDC Provider Enumeration
Expanding on Nick Frichette's discovery of enumerable OIDC providers in AWS using the known_aws_accounts dataset.
June 18, 2024
🔗 [fwd:cloudsec] The Path to Zero Touch Production
June 12, 2024
🔗 [tl;dr sec] Sub-Venture Scale Security Problems
June 10, 2024
Building to Prevent Subdomain Takeovers
Four controls platforms can use when building a custom-domain feature to make it resilient to subdomain takeover down the road
June 03, 2024
What happened to RASP?
May 24, 2024
Publicly Exposed AWS Document DB Snapshots
May 15, 2024
🔗 [tl;dr sec] Wiring a Winning Security Organization
May 13, 2024
*AST and *SPM: Acquisition Magnets
April 29, 2024
Semgrep for Terraform Security
April 25, 2024
Intentionally Leaking AWS Access Keys - GitLab
April 24, 2024
🔗 Security is a Team Sport
April 21, 2024
10 Things Your First Security Hire Shouldn’t Do
April 10, 2024
🔗 [tl;dr sec] open source - awesome-secure-defaults
April 10, 2024
🔗 [Venture in Security] Customer Love
April 01, 2024
Deciding on S3 Intelligent Tiering
February 25, 2024
The state of ABAC on AWS (in 2024)
February 14, 2024
Did your research: Prior Art for "15 ideas for cloud security research"
2023
December 09, 2023
Steampipe + Access Advisor
December 05, 2023
Quick Tip: Minimizing Terraformed SCPs
November 07, 2023
A History of Human Interaction Proofs
October 20, 2023
AWS SES Verification Phishing: A Fifth Way
August 03, 2023
Risk in AWS SSM Port Forwarding
April 29, 2023
🔗 BSidesSF 2023 Panel (video)
March 29, 2023
A Guide to S3 Logging
March 07, 2023
Reducing Attack Surface with AWS Allowlisting
January 18, 2023
🔗 Startup Security Starter Pack
January 18, 2023
🔗 AWS Lambda Risks and Threats
January 17, 2023
AWS Could Do More About SSO Device Auth Phishing
2022
December 24, 2022
AWS Phishing: Four Ways
December 22, 2022
🔗 [Datadog Security Labs] A retrospective on public cloud breaches of 2022, with Rami McCarthy and Houston Hopkins
December 06, 2022
🔗 [tl;dr sec] StaffEng Security Stories
December 06, 2022
🔗 [tl;dr sec] Buying Security
November 23, 2022
🔗 Breach List Database
July 31, 2022
Removing sensitive data from a Github repository
June 04, 2022
Buying Security: Bibliography
February 03, 2022
[Cedar] Defining Cedar's Security Values
2021
August 24, 2021
[tl;dr sec] Cloud Security Orienteering
August 08, 2021
[DEFCON Cloud Village] Cloud Security Orienteering
2020
November 14, 2020
[BSidesCT] Learning from AWS (Customer) Security Incidents
September 26, 2020
[BSides Boston] AWS Security - Easy Wins and Enterprise Scale
August 18, 2020
An AWS IAM Security Tooling Reference
July 03, 2020
Path to CCSK: Security Guidance v4 (Domains 1-7)
July 02, 2020
Path to CCSK: ENISA
April 28, 2020
Brandeis MS in Information Security Leadership
April 28, 2020
🔗 [NCC Group] The Extended AWS Security Ramp-Up Guide
April 18, 2020
$ git blame 4: Quitten/Autorize
2019
October 28, 2019
sadcloud: Templating cloud misconfigurations
October 20, 2019
[BASC] AWS Cloud Security Fundamentals
July 19, 2019
🔗 [NCC Group] One Thousand Misspelled Security Headers
2017
December 07, 2017
Methodology: Learn Android Application Security Testing
December 06, 2017
$ git blame 3: MobSF/Mobile-Security-Framework-MobSF
December 06, 2017
$ git blame 1: michenriksen/bucketlist
December 06, 2017
$ git blame 2: michenriksen/aquatone