Steven Smiley

Cloud security @ ScaleSec

[Steven Smiley @stevensmiley]

@blakegreendev That’s awesome!

[AWS Security Digest @AwsSecDigest]

Create AWS access keys that can be placed in various places to tempt bad guys. If used, you will be notified within ~4 minutes. You can then investigate that asset to determine if it may have been compromised.
https://t.co/or5vtnpbWt

[Clint Gibler @clintgibler]

🍯 aws-mine: An open source AWS honey token manager

Catch attackers & compromised assets with decoy AWS access keys

Notifies users via Amazon SNS within ~4 minutes when keys are used

By @StevenSmiley

https://t.co/ShKvtQBJXk

#cybersecurity

[Steven Smiley @stevensmiley]

@MerrittBaer

[Steven Smiley @stevensmiley]

@mattgillard Also consider https://t.co/WydMKDJnKG

[Steven Smiley @stevensmiley]

@sharkmode @wiz_io @nirohfeld @shirtamari Can you think of any other endpoint types that would allow you to append an arbitrary string at the end and still receive the notification?

[CloudSecList @CloudSecList]

📖 CloudSecList Issue 175 just got released, w/ content from @scalesec @frichette_n @__steele @TrustedSec @permisosecurity @praetorianlabs and more! https://t.co/HO9BLzxZZB

[Steven Smiley @stevensmiley]

@hashishrajan @CloudChallenges I have interviewed and hired people who did this and I’d do it again, it gives them something specific to talk about and show their enthusiasm. Better than getting a cert without ever actually building anything which seems common.

[Andrew Krug @andrewkrug]

This was a massive undertaking but I'm so excited to share our findings with the #AWS cloud #security community. Special thanks to @christophetd for the great work here.

[Steven Smiley @stevensmiley]

Good data driven analysis from Datadog on AWS security. No surprises for those of us in cloud security but we need to get better at closing these gaps.

[Datadog, Inc. @datadoghq]

We are proud to release Datadog's first security study: "The State of AWS Security - A Look Into Real-World AWS Environments"

Read the report to learn about key mechanisms to secure AWS environments and how organizations worldwide are implementing them. https://t.co/xBiNKgdizg

[What's New on AWS (Unofficial) @awswhatsnew]

AWS announces updated Support Plans Console with new IAM controls

AWS Support continues to provide a mix of tools, technology, people, and programs to help you optimize performance, lower costs, and innovate faster. Today, the new AWS Support Plans... https://t.co/go1Fgetw6y

[Clint Gibler @clintgibler]

📺 fwd:cloudsec 2022

Recordings are live!

Tons of great #cloudsecurity talks

H/T @0xdabbad00, @fwdcloudsec

https://t.co/HgzoeXXLbG

[Steven Smiley @stevensmiley]

@iann0036 @fwdcloudsec @YYanilov @mritamar_ Do you mean it’s a bad idea in general or bad idea to adopt now since we don’t yet have the gaps solved?

[AWS Blogs (Unofficial) @AWSBlogs]

New Security, Identity & Compliance post by Faraz Angabini:

Extend AWS IAM roles to workloads outside of AWS with IAM Roles Anywhere
https://t.co/BubMI20X99

[Steven Smiley @stevensmiley]

@QuinnyPig I thought there was a good chance I’d find the flag in a Route 53 database but alas it did not have permissions

[Phil Venables @philvenables]

If the goal of incident analysis is blame (vs. understanding why an event happened so recurrence can be prevented) then analysis will stop as soon as the first blamable cause is found as opposed to the true root cause.

Hence, blameless postmortems are crucial.

[Steven Smiley @stevensmiley]

@jeffbarr The good news is that migration to v2 was completely painless for all my workloads, hopefully that’s the case for others too

[Merritt Baer @MerrittBaer]

you'll want to check these out if you haven't yet: https://t.co/1Fl7QQ4tTQ

https://t.co/et6Ep0zDhj

[ScaleSec @ScaleSec]

Take a layered approach to #cloudsecurity with code-specific protections.

#Cloud #awslambda #aws #awssecurity #securecoding #lambda #defenseindepth #applicationsecurity #DevOps

https://t.co/AvokTYJLre