Plerion

Simplify cloud security

[Plerion @PlerionHQ]

Full write-up: https://t.co/c5pEHwd5ec

For more AWS security tips try Pleri, our AI cloud security teammate.
https://t.co/TMKjQbWJEz

[Plerion @PlerionHQ]

Managing network access in AWS used to mean babysitting endless lists of VPC IDs. Painful. Easy to screw up.

Now AWS has 3 new condition keys that scale:

🔑 aws:VpceAccount → restrict to accounts
🔑 aws:VpceOrgPaths → restrict to OUs
🔑 aws:VpceOrgID → restrict to your org

[Plerion @PlerionHQ]

Want a great security tool for AWS that also does the basics in GCP and Azure? Check out Plerion.
https://t.co/6VDgQYc109

[Plerion @PlerionHQ]

Diversity is the enemy of security!

No, I’m not sledging DEI. I’m saying that doing things in a million different ways - in the name of speed, innovation, or employee satisfaction - has a hidden cost. A cost most people don’t notice, because they aren’t the ones who feel it.

[AWS Startups @AWSstartups]

Meet Pleri, the newest member of your security team.

Created by @PlerionHQ & powered by #AWS services, the #AI teammate acts like a seasoned security engineer, proactively protecting systems at scale.

Ready to build your own? Plerion explains how: https://t.co/3cmP8w3ENC

[Plerion @PlerionHQ]

If you're struggling with vulnerability management in the cloud, I'd recommend having a look at Plerion's cloud security platform. We find and prioritize vulnerabilities in cloud containers, images, and code.

https://t.co/1CYvkWeV2n

[Plerion @PlerionHQ]

Vulnerability fix SLAs are common but having systems to support them is not. That's why they fail!

A vulnerability fix SLA is great because it sets the standard and expectations for everyone on how quickly each type of security issues needs to be fix.

[Plerion @PlerionHQ]

So if you've already got a vulnerability SLA in place, or are thinking of implementing one, build systems to do these 4 things:
1. Attribution
2. Notification
3. Escalation
4. Accountability

It's still going to be hard, but at least you'll have a chance.

[Plerion @PlerionHQ]

Every security capability needs a coverage metric. If you don't pair security goals with coverage goals, you're just pretending to do security.

[Plerion @PlerionHQ]

Need help with cloud security? Get a free assessment from Plerion.
https://t.co/pv5BO0GHFY

[Plerion @PlerionHQ]

Just dropped a 🔥 conversation with a non-technical CISO. I learned so much from this guy!

You don't have to be technical to be a CISO but if you make silly metrics your goal, you'll get silly results.

Tag your favourite CISO.

[Daniel Grzelak @dagrz]

My favourite part about hacking AWS and blogging about it is the good folks at AWS valiantly trying to change my clickbait titles.

I just think "How to get rekt using AWS Neptune" is way more interesting than "Best practices for using AWS Neptune".

https://t.co/mowBqZlemy

[Daniel Grzelak @dagrz]

Bad prioritization kills security teams. So I did some experiments to see if AI could help.

If you think about it, prioritization is just sorting. So why not use sorting algorithms to prioritize? The LLM can be the comparison function.

https://t.co/RbRrCEs0cJ

[Daniel Grzelak @dagrz]

I wrote some code and a guide to figure out who has access to your AWS production, through transitive trusts. It's always scary to figure this out but well worth it.
https://t.co/GWh0HmAbRN

[Plerion @PlerionHQ]

So, when you finally realize it’s your job to ask “Do you own that?” — don’t be sad. Instead, find ways to systematically identify these assets and keep their metadata up to date, so you can automate this in the future.

[Plerion @PlerionHQ]

No one will tell you this, but one of the dumbest — and most valuable — things you’ll do as a cloud security engineer is ask people, “Do you own this?”

[Plerion @PlerionHQ]

And you won’t be able to fix it — whether it’s an S3 bucket or an RDS database — unless you know who owns it. Typically, only they understand how to solve the problem without breaking the business.