🅱️re₳cʞίᴎg҉ ♓₳cʞ 💢

'Give a man an 0day and he'll have access for a day, teach a man to phish and he'll have access for life' by @thegrugq
Never stop learning 🔥

[Proton @ProtonPrivacy]

Une proposition de loi votée par le Sénat aujourd’hui suscite de sérieuses inquiétudes pour la sécurité numérique des citoyens et des entreprises en France.

[Mobile Hacker @androidmalware2]

[new blog] Bluetooth vulnerability allows unauthorized user to record & play audio on Bluetooth speaker via #BlueSpy

Prevention section explains how you can check if your Bluetooth LE speakers/headsets are vulnerable to this attack using nRF Connect app
https://t.co/TNoGhe92bv

[Binni Shah @binitamshah]

BlueSpy - PoC to record audio from a Bluetooth device : https://t.co/sv0peS2ds4

Spying on Bluetooth conversations : https://t.co/Y97MtTpDgA

[Alex Xu @alexxubyte]

What does API gateway do?

The diagram below shows the detail.

Step 1 - The client sends an HTTP request to the API gateway.

Step 2 - The API gateway parses and validates the attributes in the HTTP request.

Step 3 - The API gateway performs allow-list/deny-list checks.

Step 4 - The API gateway talks to an identity provider for authentication and authorization.

Step 5 - The rate limiting rules are applied to the request. If it is over the limit, the request is rejected.

Steps 6 and 7 - Now that the request has passed basic checks, the API gateway finds the relevant service to route to by path matching.

Step 8 - The API gateway transforms the request into the appropriate protocol and sends it to backend microservices.

Steps 9-12: The API gateway can handle errors properly, and deals with faults if the error takes a longer time to recover (circuit break). It can also leverage ELK (Elastic-Logstash-Kibana) stack for logging and monitoring. We sometimes cache data in the API gateway.

Over to you: 1) What’s the difference between a load balancer and an API gateway?
2) Do we need to use different API gateways for PC, mobile and browser separately?

—
Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): https://t.co/4QcX8btXGL

[Souveraine Tech @SouveraineTech]

⭕️ Exclusif : L'armée US a acheté un accès à une plateforme de surveillance massive d'Internet baptisée #Augury. Les données du réseau sont mises à jour quotidiennement et permettent d’accéder à 100 milliards de nouveaux enregistrements chaque jour.

https://t.co/ywKFIKntC7

[Jeffrey Appel | Microsoft MVP @JeffreyAppel7]

NEW BLOG: How to prevent MFA fatigue and learn from the Uber breach for additional protection

Tried to pack all the information into a blog, including important AzureAD protections, hunting, MITRE ATT&CK relations, and Uber story timeline.

#Uber #MFA

https://t.co/T9JA3waDDQ

[Alexandre Dulaunoy @[email protected] @adulau]

I just released git-vuln-finder v1.3 released. It's a bug fixes release. Finding potential software vulnerabilities from git commit messages. #infosec

https://t.co/0NfdXRk6IN

[Alexis Rapin @alexis_rapin]

Si le #cyber est très utilisé dans la guerre en #Ukraine, il a jusqu'ici échoué à produire des effets militairement significatifs. Pourquoi? Et que cela nous apprend-il sur les usages stratégiques du cyber? Je tente un 1er bilan d'étape pour @LeRubicon_org https://t.co/NkAMLtx5iz

[🅱️re₳cʞίᴎg҉ ♓₳cʞ 💢 @BreakingHack]

#EPP / #EDR / #NDR / #XDR : une révolution pour la #cyberdéfense ?

Très bel article de vulgarisation sur les différences entre les solutions de détection et réponse.

https://t.co/TBDA9p6l98

[Lance Spitzner @lspitzner]

The talks from the 2022 SANS Security Awareness Summit are being posted, with over 20 talks online already and more coming. This is a great opportunity to learn from others how they are managing their human risk. https://t.co/OQtzWDgQuD

[Trellix @Trellix]

@TrellixLabs Interested in a more technical look at CVE-2007-4559? @Abraxus7331 and our Advanced Research Center (@TrellixLabs) have you covered. https://t.co/uuAuz7Cjkk

[Lance Spitzner @lspitzner]

In many ways I would suggest we have become so good at using technology to secure technology that we are literally driving cyber threat actors to target the human. https://t.co/gEEfAqeFP7

[News Physa @InfoSecPhysa]

#cybersecurite
CSOonline posted "Multi-factor authentication fatigue attacks are on the rise: How to defend against them"
Full version: https://t.co/Ch84onwohQ

[France Titres - ANTS @FranceTitres]

[Rapport d’activité 2021] #ParoleExpert #Cybersécurité

Les cybermenaces aujourd’hui : la RSSI de l’ANTS dresse un panorama !

https://t.co/XEWuGDgA8x 📽️⤵️

[Geek Tech - Actualités High Tech @GeekTech_App]

Des emails qui arrivent à tous les coups avec Sendgrid https://t.co/SDMUWUH7kv via @GeekTech_App #geektech #technewsapp #Korben #Développement

[Wallarm @wallarm]

Didi you check out Postman 2022 State of the API Report? A lot of great findings and security insights. Thanks @getpostman for highlighting Wallarm as API Security solution in the API Platform Landscape!

#apisecurity #postman #postmanapi

[JC Gaillard @Corix_JC]

8 notable open-source #security initiatives of 2022 >> https://t.co/zkPlPdQxU0 via @csoonline

#cybersecurity #infosec #opensource #software #developers #development #IT #tech #digital #innovation #business #leaders #leadership #management #CISO #CIO #CTO #CDO #CEO

[BleepingComputer @BleepinComputer]

In 2022, the volume of DDoS attacks will roughly double compared to 2021. The average attack power will grow from 150–300 Gbps to 500–700 Gbps.

Andrew Slastenov, Head of Web Security, at Gcore talks about trends.

Sponsored by @gcore_labs
#cybersecurity
https://t.co/RQbMD3bMOK

[Michael Van Horenbeeck @vanhybrid]

Have been saying this for a while, now! Token replay attacks are on the rise. Don't ignore this risk and start doing the right stuff. To my point of yesterday: use PAWs for privileged access - also in the cloud! #security #azuread #microsoft365 #TEC2022