Alle afleveringen
365 afleveringen, van nieuw naar oud
-
3 THINGS THAT BROKE THE DIGITAL SUPPLY CHAIN
26 juni 2022 · 17 min
The Digital Supply Chain is broken and getting challenging to fix. In this "What to LookOut for in 2022" series - we interviewed experts at RSA and BSidesSF on the Broken Digital Supply Chain and why it has become a challenge. Lees meer
Watch the video for this episode on You Tube - 3 THINGS THAT BROKE THE DIGITAL SUPPLY CHAIN
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guests Linkedin: Thank you to Keatron Evans, Clint Gibler, Ryan F, Mike Ruth, Paul Calatayud, Shay Levi, Dylan Ayrey, Aaron Brown & Dan Gordon for participating in this episode.
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Digital Transformation - ARE WE THERE YET!
20 juni 2022 · 14 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Heather Ceylan (@heatherceylon) & Ariel Chavan (@ariel-c-ab445a50) from Zoom. Lees meer
Watch the video for this episode on You Tube - Digital Transformation in 2022
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guests Linkedin: Heather Ceylan (@heatherceylon) & Ariel Chavan (@ariel-c-ab445a50)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
CISO Perspective: Sean Catlett, CISO of Slack
15 juni 2022 · 34 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Sean Catlett (Sean's Linkedin) Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Sean Catlett (Sean's Linkedin)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
CAASM - CyberSecurity Asset Management for the Modern Security Stack
4 juni 2022 · 35 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Akash Ganapathi (Akash's Linkedin) Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Akash Ganapathi (Akash's Linkedin)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Azure Security Fundamentals - Level 200
29 mei 2022 · 53 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Tanya Janca (Tanya's Twitter) Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Tanya Janca (@shehackspurple)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Confidential Computing in Azure Explained
28 mei 2022 · 43 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Steve Orrin (Steve's Linkedin) Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Steve Orrin (Steve's Linkedin)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Azure Cloud Security Architecture
25 mei 2022 · 41 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Sai Gunaranjan (Sai's Linkedin) Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Sai Gunaranjan (Sai's Linkedin)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Azure Security Fundamentals Level 1
19 mei 2022 · 38 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Andrew Brown, ExamPro Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Andrew Brown (@andrewbrown)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Finding Security Holes in Azure Services
15 mei 2022 · 35 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Yoav Alon, CTO, Orca Security Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Yoav Alon (@yoavalon)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Azure Kubernetes Service (AKS) Security Explained
8 mei 2022 · 48 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Jimmy Mesta, Co-Founder, KSOC Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Linkedin: Jimmy Mesta
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Azure Security Fundamentals - Zero Trust with Azure AD
1 mei 2022 · 43 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Paul Schwarzenberger, Cloud Security Engineer, Celidor Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Linkedin: Paul Schwarzenberger (@paulschwarzen)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
How to Secure Cloud Managed Kubernetes
26 april 2022 · 34 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Or Azarzar from LightSpin Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Or Azarzar
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Kubernetes Security Best Practices in 2022
25 april 2022 · 41 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Ian Lewis from Google Cloud Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Ian Lewis
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Manage Privileged Access for Kubernetes & Cloud
22 april 2022 · 44 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Sakshyam Shah from Teleport Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Sakshyam Shah
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
How to become a Cloud Native Security Engineer
10 april 2022 · 45 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Pushkar Joglekar, Sr. Security Engineer, VMWare Tanzu Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Pushkar Joglekar @PuDiJoglekar
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Service Mesh Security EXPLAINED!
3 april 2022 · 50 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with William Morgan, ex Twitter, CEO Buoyant Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: William Morgan, ex Twitter, CEO Buoyant
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Scaling a Practical AWS Asset Management Program
27 maart 2022 · 40 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Jasmine Henry & George Tang from JupiterOne Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Linkedin: Jasmine Henry & George Tang
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Threat Hunting in AWS
20 maart 2022 · 43 min
n this episode of the Virtual Coffee with Ashish edition, we spoke with Eliav Livneh , Lead Security Researcher at Hunters Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Linkedin: Eliav Livneh (@eliav-livneh)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
What is SBOM, iBOM?
13 maart 2022 · 39 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Barak Schoster Goihman, Senior Director, Chief Architect at Palo Alto Networks (BridgeCrew) Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Linkedin: Barak Schoster (@barakschoster)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Security for AI/ML Models in AWS
6 maart 2022 · 55 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Mike Chambers @mikechambers, AWS Hero AI/ML Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Linkedin: Mike Chambers @mikechambers
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Building Google Cloud Security Products
3 maart 2022 · 48 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Sunil Potti @sunilpotti VP/GM, Google Cloud Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Linkedin: Sunil Potti @sunilpotti
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Google Cloud Security Fundamentals - Level 2
27 februari 2022 · 40 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Jonathan Brodie Senior Cloud Security Engineer, ITV Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Jonathan Brodie
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Google Cloud Security Fundamentals
20 februari 2022 · 34 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Antoni Tzavelas (@antoniscloud) Google Cloud Certification Trainer, Antoni Training Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Antoni Tzavelas (@antoniscloud)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
Red Team in Google Cloud
13 februari 2022 · 51 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Brad Richardson (@Richarjb) Red Team and Vulnerability Management Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Brad Richardson (@Richarjb)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security News
- Cloud Security Academy
-
How to Automate Security in Google Cloud?
6 februari 2022 · 54 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Jason Dyke (@jasonadyke) a Staff Security Engineer at Blocks (@Blocks). Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Jason Dyke (@jasonadyke)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
Authorization Control for Enterprise in Cloud
30 januari 2022 · 42 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Gal Helemski (@Linkedin-Gal Helemski) CoFounder, CTO & CPO at PlainID (@plainID_authZ). Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Gal Helemski (@Linkedin-Gal Helemski)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
McFee and FireEye join forces for XDR
26 januari 2022 · 4 min
Cloud Security News this week 26 Jan 2022 Lees meer
Early December on Cloud Security News, we shared that Symphony Technology Group had acquired McAfee for 4 Billion along with FireEye for 1.2 Billion. The merger of these two companies has now form Trellix, which aims to be a leader in extended detection and response (XDR). In their blog post Trellix shared that “Customers can expect Trellix’s living security platform to deliver bold innovation across the XDR market.” - “with automation, machine learning, extensible architecture, and threat intelligence.” You can find out more about Trellix and read their blog post here and let us know if you are excited about this merger?
Orca Security is back in the news this week, not for their funding round or their vulnerability findings in AWS. They have made their 1st acquisition: RapidSec, an Israeli cybersecurity startup that protects web applications from client-side attacks. RapidSec’s software allows for detection of web-application misconfigurations and deviations from best practices. Orca has indicated that it plans to integrate these web services and API security technologies into its agentless cloud security platform. You can read more about this acquisition here.
Cloud Security Firm Polar Security that has emerged from Stealth With $8.5 Million Seed Funding. They are a Tel Aviv, Israel-based cloud security company that aims to provide visibility into companies’ cloud data storage to allow security teams to secure the data and avoid compliance problems. You can find out more about them here
Hunters.ai announced that it has raised a $68 million Series C round bringing their total funding to date to $118 million. Hunters share in their blog that “Never before has it been more lucrative to be a cyber criminal” and “On the defenders’ side, we see organizations struggling to keep pace. As technology advances and more tools are being used, the attack surface grows and the number of security products used by these organizations …
-
AWS IAM Getting Started
23 januari 2022 · 41 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Ian Mckay (@iann0036), a AWS Community Hero, AWS APN Ambassador who has a lot of popular open sources projects in the AWS security space. Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Ian Mckay (@iann0036)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
Remote Access Trojans target Public Cloud Infrastructure
19 januari 2022 · 7 min
Cloud Security News this week 19 Jan 2022 Lees meer
Cisco Talos Researchers have shared in a blog last week that a trio of remote access Trojans (RATs)—Nanocore, Netwire and AsyncRAT—are being spread in a campaign that taps public cloud infrastructure and is primarily aimed at victims in the U.S., Italy and Singapore. According to the blog “Threat actors are increasingly using cloud technologies to achieve their objectives without having to resort to hosting their own infrastructure,” and “cloud services like Azure and AWS allow attackers to set up their infrastructure and connect to the internet with minimal time or monetary commitments. It also makes it more difficult for defenders to track down the attackers’ operations.” Read more about this here.
Netskope also released a blog last week about Malwares. Interestingly their research which surveyed millions of users worldwide from January 1, 2020 to November 30, 2021 found that Cloud-delivered malware is now more prevalent than web-delivered malware, accounting for 66%, up from 46% last year. They also found that Google Drive is the top app for most malware downloads and Cloud-delivered malware via Microsoft Office nearly doubled from 2020 to 2021. Read the report here
Vulnerability in AWS’s cloudformation service that was discovered and shared by Orca Security. Orca Security confirmed that AWS completely mitigated within 6 days of their submission.If you want to know more about their discovery, you can read it here
The US government is reportedly reviewing the cloud computing arm of Chinese ecommerce giant Alibaba to determine whether or not it poses a risk to national security.” As reported by Reuters, the Biden administration launched the probe to find out more about how Alibaba Cloud stores the data of US clients including personal information and intellectual property and to see if the Chinese government could gain access to it. You can read Reuters report here
Sysdig’s platform who were recently valued at 2.5 Bil…
-
Secret Management for Modern Apps Explained
16 januari 2022 · 49 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Dylan Ayrey (@insecurenature) is a Professional Hacker and Co-Founder of Truffle Security (@trufflesec) Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Dylan Ayrey (@insecurenature)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
CISO in a Cloud World in 2022 - Stu Hirst
12 januari 2022 · 40 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Stu Hirst (Linkedin-Stu Hirst) is the Chief Information Security Officer (CISO) of Trustpilot (@Trustpilot). Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Stu Hirst (Linkedin-Stu Hirst)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
UK Financial Regulators monitoring Cloud Providers Closely
12 januari 2022 · 4 min
Cloud Security News this week 12 Jan 2022 Lees meer
UK’s financial regulators - The Prudential Regulation Authority is looking to increase it’s monitoring of Cloud providers like AWS, Azure and Google Cloud. According to Financial times, they are looking to gain more access to data from these cloud providers because the impact outages and cyberattacks have on British Banks. They are looking at implementing more robust outages and disaster recovery tests given the increasing reliance UK banks have on a handful of cloud providers. A lot of major British banks have partnerships with cloud providers “AWS has announced deals with Barclays and HSBC, while Lloyd Banking Group holds partnerships with Google Cloud and Microsoft Azure.”. There is an increasing concerns about the impacts on the banks should these cloud providers experience outages. You can view the financial times article here
Speaking of regulators and how they are dealing with cloud providers, a few weeks ago in December Chinese regulators have “suspended an information-sharing partnership with Alibaba Cloud Computing” over concerns that it failed to promptly report and address a cybersecurity vulnerability. According to 21st Century Business Herald, citing a recent notice by the Ministry of Industry and Information Technology “Alibaba Cloud did not immediately report vulnerabilities in the popular, open-source logging framework Apache Log4j2 to China's telecommunications regulator”.This comes after, according to Reuters “The Chinese government has asked state-owned companies to migrate their data from private operators such as Alibaba and Tencent to a state-backed cloud system by next year.” From what we understand, there is no statement from Alibaba Cloud on this yet. You can read more about this here.
Gartner's Report can be found here.
Redhat's Report can be found here.
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
Instagram - Cloud Security News
If you want to watch videos of this LIVE STREAMED …
-
Building Modern Identity (IAM) Roadmap for Cloud
9 januari 2022 · 49 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Fred Wilmot (@fewdisc) is an ex-Veteran and Chief Information Security Officer (CISO) of JumpCloud (@JumpCloud). Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Fred Wilmot (@fewdisc)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
Google invests in Security + Microsoft's Log4Shell Update
5 januari 2022 · 5 min
Cloud Security News this week 5 Jan 2022 Lees meer
Google has acquired security orchestration, automation and response (SOAR) provider, Siemplify. Neither company has disclosed any amounts however sources including Reuters report Google paid $500 million for Siemplify. Google has shared that Siemplify “will join Google Cloud’s security team to help companies better manage their threat response”. They shared in their announcement that “Providing a proven SOAR capability unified with Chronicle’s innovative approach to security analytics is an important step forward in their vision”. You can find more about this here
Microsoft in their updated Blog this week on this issue have noted “Exploitation attempts and testing have remained high during the last weeks of December”. They also stated that they had “observed many existing attackers adding exploits of these vulnerabilities in their existing malware kits and tactics, from coin miners to hands-on-keyboard attacks”. Microsoft mentions that “customers should assume broad availability of exploit code and scanning capabilities to be a real and present danger to their environments. And “this is expected to have a long tail for remediation, requiring ongoing, sustainable vigilance” . Microsoft have reported that the bulk of attacks have been related to mass scanning by attackers attempting to thumbprint vulnerable systems, as well as scanning by security companies and researchers. You can read their updated blog here.
Back in 2019 you probably heard about Autom Attack which targeted misconfigured docker APIs to gain network entry to set up a backdoor on the compromised host to do cryptomining. This cryptomining campaign has evolved in the last 3 years to improve on their defense evasion tactics to fly under the radar and avoid detection. You can see the blog and their findings here.
SEGA Europe have disclosed that they were storing sensitive data in an unsecured Amazon Web Services (AWS) S3 bucket. This was discovered during a cl…
-
Building Scalable Authorization in Cloud Native Apps
2 januari 2022 · 50 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Or Weis (@OrWeis) co-founder and CEO of Permit.io (@permit_io). Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Or Weis (@OrWeis)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
The Latest with Log4J
22 december 2021 · 4 min
Cloud Security News this week 22 December 2021 Lees meer
Most folks in cybersecurity have been consumed with all things Log4shell with a CVSS score of 10, since last week. Check out last week’s episode or our special feature on Log4shell on YouTube by Ashish Rajan if you want to know a bit more about how it started and what its all about So, where have things landed with it all so far.
To remedy the Log4Shell vulnerability, Apache has issues several patches however with each patch, additional issues were reported. The latest patch is the third installment 2.17.0 to address a new vulnerability that allow for denial of service attacks. While apache and other organisations rush to remedy and patch these vulnerabilities, an explosion of attacks continue. Belgium’s defence ministry revealed that it had been forced to shut down parts of its network after a hacker group exploited log4j to gain entry to its systems. Security firm Check Point has been monitoring the situation and, at one point, reported seeing more than 100 Log4J attacks per minute.The hackers are scattered globally. Checkpoint further reported that more than half of the exploits come from well-known hacking groups using it to deploy common malware like Tsunami and Mirai. Sentinel one has reported that “Observed exploit attempts in the wild thus far have led to commodity cryptominer payloads or other known and commodity post-exploitation methods. They expect further opportunistic abuse by a wide variety of attackers, including ransomware and nation-state actors.”
The latest apache update is available here. The SentinelOne blog is available here and Checkpoint blog is available here,
Whilst we are scrambling to stay on top log4Shell, a few exciting things have occurred in the world of Cloud Security as well, Ermetic announced a $70 million series B funding round. Their platform secures cloud infrastructure by focusing on identity security and reducing the attack surface across a multi-cloud deployment. The platfor…
-
Log4j - How the Cloud Providers responded!
15 december 2021 · 3 min
Cloud Security News this week 15 December 2021 Lees meer
This week, the world of cybersecurity has been consumed by the Log4Shell vulnerability. So whats it all about. Log4j is a Java library for logging error messages in applications. It was developed by the open-source Apache Software Foundation and is a key Java-logging framework. The critical zero day security vulnerability has been named ‘Log4Shell’ and has a maximum CVSS ( Common Vulnerability Scoring System ) score of 10. The zero-day had been exploited at least nine days before it surfaced on Thursday. This vulnerability puts any device connected to the internet and running Apache Log4J, versions 2.0 to 2.14.1.at risk. This impacts cloud services, developer services, security devices, mapping services, and more.
AWS has released details on how the flaw impacts its services and said it is working on patching its services that use Log4j and has released mitigations for services like CloudFront. This can be viewed here. Microsoft has also released Guidance for preventing, detecting, and hunting for Log4j exploitation here and Google cloud is also “is actively following the security vulnerability” and has released recommendations for investigating and responding to the Apache “Log4j 2” vulnerability here IBM said it is "actively responding" to the Log4j vulnerability across IBM's own infrastructure and its products, can be found here and Oracle has issued a patch too here. There is a comprehensive list of all known softwares vulnerable and not vulnerable to LogShell is available on GitHub along with any known fixes. Here
This vulnerability is being exploited to install malware, crypto mining, perform DDOS attacks, drop Cobalt Strike beacons, scan for vulnerable servers and exfiltrate information.
To finish on a note other log4J - Have you heard about Dazz? Well if you haven't, they are a one-year old cloud security remediation startup that recently closed another round of funding and raised 60 million dollars. Dazz i…
-
AWS Outage - What is impacted?
8 december 2021 · 4 min
Cloud Security News this week 8 December 2021 Lees meer
If you use AWS, you may have noticed some issues with your services this week. AWS reported on Tuesday morning that they were seeing impacts to multiple APIs in the US-East 1 region. The issues were impacting their monitoring and incident response tooling impacting their ability to provide timely updates. A bit later they reported that they had identified the root cause of the issue causing service API and console issues. Root logins for consoles in all AWS regions were affected by this issue, however customers could login to consoles other than US-EAST-1 by using an IAM role for authentication. Services impacted include: EC2, Connect, DynamoDB, Glue, Athena, Timestream, and Chime. Most of the services have now recovered and all updates can be viewed here
Recently McAfee and FireEye announced the availability of new cloud security capabilities on Amazon Web Services (AWS) as well as integration with the Amazon Inspector vulnerability management service. According to McAfee Enterprise and FireEye, their behavior analysis and machine-learning extended detection and response (XDR) capabilities combined with Amazon Inspector promises to deliver AWS customers greater visibility and protection of cloud-based applications and data.
The research team at LightSpin discovered that the Jupiter Notebook instance of SageMaker could reach the Notebook Instance metadata endpoint. For context, having access to the metadata endpoint and requesting access tokens from an over-permissive IAM Role is a very well known SSRF vulnerability in AWS. In this case, the research team reported their finding to AWS and this has been resolved since. You can learn more about this here
Zscaler, an American cloud-based information security company known for their Zscaler private and internet access and now the creators of Zero Trust Exchange platform have now announced the general availability of its new Workload Communications solution, which is par…
-
AWS re:Invent 2021 - All the Cloud Security Updates so far
2 december 2021 · 7 min
Cloud Security News this week 2 December 2021 Lees meer
AWS has launched some improvements to a few of their existing services and no new Security service has been announced yet. With Google Cloud announcing their CyberSecurity Action team earlier this year, we were hoping for a similar response or better from AWS but nothing so far.
Updates to AWS Shield, Amazon Cloud Guru and Amazon Inspector.
For those storing CloudTrail logs or other important logs to help with incident response in S3 buckets, you can now use EventBridge to build applications that react quickly and efficiently to changes in your S3 objects. This will deliver responses to potential Events/incidents of interest in a faster, more reliable, and in a more developer-friendly way than ever. More on this here
If you use AWS Control Tower and care about Data Residency, now you will be able to apply Preventive and detective controls that prevent provisioning resources in unwanted AWS Regions by restricting access to AWS APIs through service control policies (SCPs) built and managed by AWS Control Tower. This means that content cannot be created or transferred outside of your selected Regions at the infrastructure level. More on this here
They have announced Amazon VPC IP Address Manager (IPAM), a new feature that provides network administrators with an automated IP management workflow.making it easier to organize, assign, monitor, and audit IP addresses in at-scale networks. More on this here
new feature.” Amazon VPC Network Access Analyzer. In contrast to manual checking of network configurations, which is error-prone and hard to scale, this tool lets you analyze your AWS networks of any size and complexity. You can get started with a set of Amazon-created scopes, and then either copy & customize them, or create your own from scratch. More on this here
A new Amazon S3 Object Ownership setting and the Amazon S3 console policy editor. More on the
Episode Show Notes on Cloud Security Podcast Website.
Podcas…
-
Palo Alto Investors told: "18- 24 months ahead" of competition
24 november 2021 · 5 min
Cloud Security News this week 24 November 2021 Lees meer
CSA recently announced that they have now had 1500 Cloud services evaluated across to the STAR registry principles. According to CSA, by publishing to the registry organizations can show current and potential customers their security and compliance posture which may prevent the need for them to complete multiple security questionnaires. You can find more information about CSA and STAR registry here
Security researcher Schütz was rewarded a $4,133 bounty by the Google Vulnerability Rewards Program for his Google Internal API vulnerability discovery. Google has now fixed this bug. You can read more about this here and the Schütz has documented his discovery here
Palo Alto Networks - a well known cybersecurity Vendor - Their Chairman and CEO Nikesh Arora told investors that they are “18-to-24 months ahead from a competitive platform perspective”. There a few exciting players in the Cloud Security Market right now and you can read more about this here You can also find more about Palo Alto, Orca Security, Wiz and Lacework on the links
Lacework, they have recently raised $1.3 billion in fresh capital at a valuation of $8.3 billion, making this one of the largest venture funding rounds of the year in the United States. Nasdaq covered a bit more about this here. In comparison Orca Security raised $550 million in Series C funding to raise their valuation to $1.8 Billion and Wiz raised $250 million on a $6 billion valuation
Clubhouse, an audio based chatroom launched in 2020 which gained popularity during the pandemic has launched a BugBounty program on HackerOne. The scope of the Bounty includes their API and websites. The program has upto $3000 on offer for any critical vulnerabilities reported. You can find more about the program here
Using a compromised password, an unauthorised third party has managed to infiltrate GoDaddy’s systems affecting atleast 1.2 million users. Along with usernames, passwords and emails, the …
-
Breaking and Building Serverless Application Security
21 november 2021 · 52 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Andrew Krug (@andrewkrug) is a AWS Re:invent speaker and Cloud Security Evangelist at DataDog (@DataDogHQ). Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Andrew Krug (@andrewkrug)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
Feds go "Cloud Smart"+ Alibaba Cloud targeted by Hackers
17 november 2021 · 5 min
Cloud Security News this week 17 November 2021 Lees meer
According to a research by Trend Micro, Elastic Computing Service (ECS) instances for Alibab Cloud are becoming an increasingly common target for financially motivated hackers with cryptomining goals. This increased targeting may be due to a few unique features of Alibaba Cloud. Alibaba ECS instances come with a preinstalled security agent and provides root access/ privileged control by default. There is a detailed article attached about this here
JupiterOne (a Cyber Asset Management Platform ) and Cisco have announced the launch of Secure Cloud Insights, an expanded cloud security and security operations partnership designed to provide businesses with a range of cybersecurity services. This new solution is aimed at helping Cisco customers achieve a higher level of maturity with their digital transformation and security program. CEO of Jupiter One, Erkang Zheng calls it a game changing offering - that would provide increased visibility, efficiency, and speed to security operations, with combined context from situational awareness and structural data. We would be curious to know if you think the same.
Those familiar with Palo Alto and their core cloud-security package, Prisma may be intrigued to know that they have launched Prisma 3.0.
Truffle Security has released an open source hacking tools called Driftwood designed to discover leaked, paired private and public keys which may be harmful. Driftwood builds upon Truffle Hog and is available on Github. Truffle Security in their blog which is shared here. stated that With this tool they found the private keys for hundreds of Transport Layer Security certificates, and Secure Shell keys that would have allowed an attacker to compromise millions of endpoints/devices.
The Federal government is going from a “Cloud First” to a “Cloud Smart” strategy to leverage cloud without compromising security. They quoted that “Cloud Smart is about equipping agencies with the tools and…
-
Challenges with Building Serverless Applications at Scale
14 november 2021 · 38 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Ran Ribenzaft (@ranrib) is an AWS Serverless Hero, Forbes under 30 and the co-Founder of Epsagon (@Epsagon). Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Ran Ribenzaft (@ranrib)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
Microsoft releases CSPM for AWS & More Linux Security Support on Azure
10 november 2021 · 4 min
Cloud Security News this week 10 November 2021 Lees meer
Microsoft is extending its native cloud security posture management (CSPM) and workload protection capabilities to Amazon Web Services (AWS) - yes you heard that right! within a suite called Microsoft Defender for Cloud. This was previously know as Azure Security Center and Azure Defender At their annual conference Ignite 2021, their focus was enterprise cloud protection, specially multi cloud environments. Microsoft Defender for Cloud will now let organizations secure AWS and Azure environments from one place without depending on the AWS Security Hub. We will bring you the highlights from Ignite 2021 next week, you can check out the event virtually here
For folks who have been waiting on better security services support for Linux on Microsoft Azure - they recently announced the expansion of the Defender for Endpoint on Linux capabilities. Defender for Endpoint is a cloud-based product that includes vulnerability management and assessment, and endpoint detection and response (EDR) on Linux servers.
Are you wondering about Oracle Cloud and what they are upto? Oracle Cloud most recently trying to stand out amongst its competitors by broadening the range of built-in and add-on cybersecurity features in Oracle Cloud Infrastructure. Oracle said the new features are intended not only to simplify management but also to address the problem misconfiguration and user error. If you want to find out more - you can check out their new Oracle Cloud Infrastructure Web Application Firewall for Flexible Load Balancers, Oracle Cloud Infrastructure Vulnerability Scanning Service, Oracle Cloud Infrastructure Bastion and Oracle Cloud Infrastructure Certificates
If you use Crowdstrike, this ones for you. The popular real-time detection and automated response software, Crowstrike is making some big moves in the Cloud Space, doubling down on zero trust.
The National Security Agency (NSA) and CISA have published the first of a four-part s…
-
Security Governance and Compliance in Serverless Applications
7 november 2021 · 38 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Jon Zeolla (@jonzeolla ) is a Cloud Native Contributor, co-founder CTO of Seiso. Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Jon Zeolla (@jonzeolla )
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security News
- Cloud Security Academy
-
AWS Earns over 16billion this quarter + SEGA on Microsoft Azure - Cloud Security News
3 november 2021 · 3 min
Cloud Security News this week 27 October 2021 Lees meer
In case you missed the quarterly earnings updates from last episode, I do encourage you to check it out to see how Google Cloud and Azure faired last Quarter. AWS came out still leading the pack $16.11 billion in the quarter, up almost 39% from a year ago. You can view the report here
Industry Tech giants including Google, Salesforce, Okta and Slack have announced the creation of a “vendor-neutral” security baseline for businesses called ‘Minimum Viable Secure Product’ (MVSP). Its a minimalistic security checklist for B2B software and business process outsourcing supplier designed to eliminate overhead, complexity and confusion during the procurement and vendor security assessment process by establishing minimum acceptable security baselines. The intention is to increase clarity reduce the onboarding and sales cycle by weeks or even months. You can view the checklist here
Remote code execution vulnerability was patched by Gitlab in April 2021 however researchers from Rapid 7 recently found that the exploitations were continuing to this day, with only 21% of the instances fully patched against the issue. Gitlab strongly recommends updating to the latest version to remedy this. Read more about Rapid 7’s research here and Gitlab’s release here
IBM has released their report - Cloud’s Next Leap. They surveyed over 7000 executives in enterprise cloud adoption over 44 countries. 59% of organizations reported that digital transformation has accelerated for them through the pandemic. Not dissimilar to other reports this year, most of their respondents are also yet to fully realize cloud’s full transformational power. Hybrid cloud/multicloud once again is reported to be the dominant architecture for cloud service delivery. Something rather interesting they reported on is that while many organisations are moving to the cloud, they are often moving to different versions of it.Report here
For our sonic hedgehog gaming fans, Tok…
-
How to Build Applications with Zero Trust Principles
31 oktober 2021 · 42 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Maximilian Burkhardt (@maxb) is a Staff Security Engineer at Figma (@Figma) Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Maximilian Burkhardt (@maxb)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security Podcast - www.cloudsecuritypodcast.tv
- Cloud Security News
- Cloud Security Academy
-
What is SaaS Security Posture Management (SSPM)?
28 oktober 2021 · 21 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Chris Hughes (@Linkedin-Profile) is a host of the Resilient Cyber Podcast. Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Chris Hughes (@Linkedin-Profile)
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security Podcast
- Cloud Security News
- Cloud Security Academy
-
AWS Lands UK Spy Services Contact + Google Cloud + Azure release Q3 results - Cloud Security News
27 oktober 2021 · 6 min
Cloud Security News this week 27 October 2021 Lees meer
UK’s spy agencies have given a contract to AWS to host classified material. Their intention is to boost use of data analytics and artificial intelligence for espionage. The agreement, estimated by industry experts to be worth £500m to £1bn over the next decade. The Guardian has reported that “the contract with Amazon is likely to ignite concerns over sovereignty because the UK’s most secret data will be hosted by a single US tech company” - Quite the interesting comment and Cloud Security News would love to hear your thoughts on this
It's also the season for Revenue announcements for Quarter 3 for our big cloud providers. Google announced this week that Google Cloud revenue jumped 45 percent to $4.99 billion in the third quarter compared to the same period last year. You can view the results here
Microsoft also announced their Quarter 3 revenue for Intelligent Cloud to be $17.0 billion, an increase of 31% - You can view the results here
Microsoft shared earlier this month that things remain “Business as usual for Azure customers despite 2.4 Tbps DDoS attack” in Europe. They reported that the attack traffic originated from approximately 70,000 sources and from multiple countries in the Asia-Pacific region. Read the full statement from Microsoft here
The Microsoft Threat Intelligence Center (MSTIC) has detected nation-state activity associated with NOBELIUM. It's quite the interesting read and the full blog can be found here.
If you use discourse, a popular open source forum software, you should make sure that you update to Discourse versions 2.7.9 or later, as a security bug has been found that affects Discourse versions 2.7.8 and earlier.
Read the Discord blog here
Episode Show Notes on Cloud Security Podcast Website.
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
Instagram - Cloud Security News
If you want to watch videos of this LIVE STREAMED episode and past episodes, check out:
- Cloud Security …
-
Threat Detection and Incident Response in Cloud - Nathan Case
24 oktober 2021 · 47 min
In this episode of the Virtual Coffee with Ashish edition, we spoke with Nathan Case ( Linkedin Profile ) is a Senior Director, Security Operations at Resilience. Lees meer
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Nathan Case ( Linkedin Profile )
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our YouTube Channel:
- Cloud Security Podcast
- Cloud Security News
- Cloud Security Academy