Cloud Security Posture Management is an automated set of security tools that continuously monitors cloud environments, to identify, assess, and remediate misconfigurations and compliance risks. Its existence is a direct response to the Shared Responsibility Model in the cloud. Cloud providers secure the cloud itself (hardware, global infrastructure), but the customer is responsible for securing what Read More …
Tag: aws
RCP – Resource Control Policies
Resource Control Policies in Amazon Web Services (AWS) are a set of rules and guidelines that govern how resources within the AWS environment can be accessed, managed, and utilized. These policies are used for maintaining security, compliance, and efficient resource management in cloud environments. RCPs can help organizations define who can access specific resources, what Read More …
ENI – Elastic Network Interface
An Elastic Network Interface is a virtual network interface that can be attached to an Amazon Web Services instance, such as an Elastic Compute Cloud instance. Understanding ENIs is essential when working with cloud computing and networking within AWS. Here’s a detailed overview: Key Features of ENIs Virtual Network Interface: An ENI acts like a Read More …
Tool Overview – Shimit
Shimit is a Python-based tool that facilitates the execution of the Golden SAML attack. This attack method allows an adversary to forge SAMLResponse objects, which are then used to bypass authentication and gain unauthorized access to applications relying on SAML for single sign-on. By crafting a signed SAMLResponse, attackers can impersonate any user and achieve Read More …
SCP – Service Control Policies
Service Control Policies are a feature of AWS Organizations that allow administrators to manage permissions across multiple AWS accounts in a centralized manner. SCPs provide a way to define the maximum available permissions for accounts within an organization, ensuring that security and compliance requirements are met while allowing flexibility in resource management. Organizations can enforce Read More …
Cloud Formation Example
Imagine you’re a System Administrator tasked with setting up a new environment. Traditionally, this involves a long checklist: log into the console, click through menus to create a VPC, spin up three VMs, configure storage, attach security groups, and set up a load balancer. If you need a second environment for testing, you have to do Read More …
Zig: The New Foundation for Modern Malware
This year Zig has moved from a niche systems language to a new primary choice for high-sophistication malware in 2026. Its design as a “better C” provides the low-level control required for weaponization without the legacy baggage that makes C code prone to crashes or easy detection. Is Zig is Over passing C and Rust Read More …
CDR – Cloud Detection and Response
I have witnessed the evolution of security from a static, perimeter-focused discipline to a dynamic practice centered on data and identity. The shift to the cloud had been the most significant disruption, introducing a level of complexity that traditional security tools were never designed to handle. This is the operational reality that has given rise Read More …
Demystifying VDI with AppStream
I’ve seen technology trends come and go, but one area that continues to evolve is the virtual desktop. The age of complex, on-premise Virtual Desktop Infrastructure is fading in my opinion and it will slowly be replaced by the agility of cloud-native solutions. A recent dive into Amazon AppStream and its potential as a “Citrix Read More …
Invictus :: Profiling TraderTraitor
TraderTraitor, a DPRK-nexus threat actor known for state-sponsored financial gain to fund North Korea’s nuclear weapons programs and engage in espionage. TraderTraitor primarily targets AWS environments, the cryptocurrency industry, and adjacent financial sectors through supply chain compromise, credential theft, and cloud service abuse. They are responsible for major crypto heists, including $625 million from the Read More …