Blurring of traditional perimeters with the emergence of cloud has led to rise of new threats. This talk by Rod Soto takes us through some of the attack scenarios and how defenders can implement detection to address these new threats.
On AWS, Lambda Authorizers are frequently used with API Gateway, however, one must be careful when working with the policy documents for Lambda Authorizers. This tech talk by Alexandre & Leonardo takes you through interesting examples to showcase the attack vectors for APIs using the AWS API Gateway Lambda Authorizers.
A walkthrough of the slides presented during the fwd:cloudsec 2021 conference with details of findings and observations across different resources within the IBM cloud platform.
Elastic IP addresses are static public IPv4 addresses provided by AWS. These can be moved or re-associated between instances and Elastic Network Adapters easily and hence, are a choice for many users for their public facing applications. This article shares 5 tips that one can consider when working with Elastic IPs.
The AWS RDS service, by default, does not enable transport layer security, allowing clients to connect insecurely if they want to. This article shows how SREs, DevOps, and RDS administrators can lower the risk that this default configuration poses.
Google Cloud Armor has a documented limitation related to the maximum size of an HTTP POST request body the service is able to inspect and block. Attackers can use this limitation to bypass the protection provided by Cloud Armor and potentially exploit vulnerabilities that may be present in an underlying web application. This article will take you through how Cloud Armor rules can be configured to appropriately mitigate the risk due to the limitation.
