Olivia
Online
Tolven
@infosec_coder
Cloud whisperer. πΊπΈ π©πͺ π«π· π°π·
@hacknotcrime advocate
Stark sein bedeutet, immer zu lernen β€οΈ @EISBRECHER
Joined May 2022
1.6K Following
100 Followers
12.6K Posts
Β Pinned Tweet
π’ The DevSec Blueprint π’
A comprehensive, free, and open-source learning guide for DevSecOps.
AWSome Founder: π₯@damienjburksπ₯
#aws #infosec #linux #webdev #devops #devsecops #database
https://t.co/FiDk8V7nLW
π₯ π οΈ AWS Community Hero - Anton Babenko π οΈ π₯
#aws
@antonbabenko
#infosec #linux #webdev #devops #devsecops #database
π₯ https://t.co/acb1iwXSKx π₯
Who to follow
Dhruvin Kavathiya
@dhruvinK79
curious π
Atulmaharaj π₯
@TheTechMaharaj
Principal Developer Advocate | CNCF Ambassador | Platform Engineering | @cncfhyd Organizer | Blogger | Storyteller | Food & Travel π @atulmaharaj
Millie
@Zamunda58694424
Passionate follower of Jesus, I seek to bridge faith and technology to serve God's purpose.
I have a few pieces of cybersecurity advice for anyone willing to listen:
Reduce the number of vendors your core security depends on.
Expect lots of small, medium-sized, and even some large security / services companies to get compromised in the next year or so, if they aren't already.
Put most of your trust in the absolute top tier of companies in terms of security and engineering.
These are companies like Google, Apple, and (I would argue) Cloudflare. A good heuristic is how big and talented their security teams, and how much money their company invests in security.
If there is a security issue in Chrome, or iOS, for example, you can be damn sure that hundreds or thousands of the smartest people in the world are working to fix it. And these companies would be willing and/or happy to spend tens of millions of dollars instantly to solve the issue.
I'm not going to name companies, but there are many applications and services out there for managing keys, passwords, source code, secrets, etc., where the security teams are decent, but they're basically large startups. The security teams are far more varied in talent levels and budget levels.
Basically we're about to be hit with a tidal wave (or global forest fire, pick your metaphor) of both advanced and persistent attacks with existing vulnerabilities, as well as lots of completely new attacks nobody's seen before.
You want to have your personal and company security relying on as few of these small to medium sized companies as possible. Not because they're totally incompetent, but because many of them are likely not up to the challenge of defending against millions of agents running open source attack models and harnesses.
Look at your whole security tech stack. See where you can reduce dependency on small-to-medium sized Jenga blocks that have a high chance of getting compromised during this storm.
And remember, it's not just that the teams and budgets aren't as big as companies like Google and Apple. It's also the fact that these companies (like password managers, for example) are so damn attractive.
Millions of users and their passwords. These are not good places to have credentials right now. Or data. Or infrastructure.
This is not an absolute thing. I'm not saying cancel all engagements and get our of all small companies or whatever. Or that the big ones will be perfect either.
I'm saying, as a general truth, on the whole, moving in this direction is likely to make you more secure while this thing hits us.
Breaking into a new field feels impossible until it finally happens. After months of silence and rejection, one pivot point changed everything.
Check out the full episode of the Phillip Wylie Show on YouTube, Apple, or Spotify.
#CareerPivot #CyberSecurity #CareerChange #DevOps
π₯ π οΈ Kubernetes and Flask π οΈ π₯
@AWS @AWSUserGroups
#infosec #linux #webdev #devops #devsecops #database
π³ Confirmed the Flask application is responding successfully through Docker on port 5000.
β€οΈ tech life
How to get the current database transaction id
https://t.co/8MDi8nyKR1
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
π₯ π οΈ AWS - S3 LifeCycle Configurations π οΈ π₯
#aws #infosec #linux #webdev #devops #devsecops #database
@AWS @AWSUserGroups
Learn how to manage secure storage in AWS using S3 lifecycle configurations.
https://t.co/zQdrpDEHsW
β€οΈ tech life
Last Seen Users on Sotwe
Desiboy420
Seen from Netherlands
sadece karisini paylasan kavatlar
viviana
Seen from Indonesia
CARDEL
Seen from Turkey
Black For Wife
Seen from Turkey
shakila
Seen from Malaysia
Camille
Seen from Mexico
Ejaculation Station
Seen from Turkey
ali
Illimitable Man Bot β’ Red Pill 
Seen from United States
Trends for you
Most Popular Users
Elon Musk
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers