Daily digest for Security Boulevard, on July 28, 2022

Mark Rasch posted: "Recent news reports indicate that the United States Secret Service, as part of a hardware replacement policy for agents' phones, allowed individual agents to wipe all of the data from their devices, and failed to preserve text messages as required both by" Security Boulevard Not-So-Secret Service: Text Retention and Deletion Policies Mark Rasch Jul 28 Recent news reports indicate that the United States Secret Service, as part of a hardware replacement policy for agents' phones, allowed individual agents to wipe all of the data from their devices, and failed to preserve text messages as required both by federal law and pursuant to demands from both Congress and the USSS's oversight […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/not-so-secret-service-text-retention-and-deletion-policies/ Powered by Jetpack

George V. Hulme posted: "Following months of pushback from private industry, the Transportation Security Administration (TSA) reissued a revised version of its cybersecurity directive for oil and natural gas pipeline owners and operators. The directive follows the May 2021 ransom" Security Boulevard TSA Issues Directive to Prevent Another Colonial Pipeline Attack George V. Hulme Jul 28 Following months of pushback from private industry, the Transportation Security Administration (TSA) reissued a revised version of its cybersecurity directive for oil and natural gas pipeline owners and operators. The directive follows the May 2021 ransomware attack on Colonial Pipeline. That attack impacted fuel transformation and caused widespread disruption to fuel availability. The attack brought […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/tsa-issues-directive-to-prevent-another-colonial-pipeline-attack/ Powered by Jetpack

Alexa Sander posted: "It's no shock that K-12 school districts have their hands full when it comes to bullying. After all, physical and verbal harassment have challenged student safety for generations. But today, newer forms of online bullying are posing an even graver threat " Security Boulevard Reducing cyberbullying with reporting technology Alexa Sander Jul 28 It's no shock that K-12 school districts have their hands full when it comes to bullying. After all, physical and verbal harassment have challenged student safety for generations. But today, newer forms of online bullying are posing an even graver threat to mental health and wellbeing. And as tough as it is to admit, many […] The post Reducing cyberbullying with reporting technology appeared first on ManagedMethods. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/reducing-cyberbullying-with-reporting-technology/ Powered by Jetpack

Tripwire Guest Authors posted: " Malware – what are the threats? Malware can come from and in a variety of attack vectors. Besides using 'traditional' methods of spreading malware, adversaries can leverage more sophisticated methods to turn your Power System into a 'malware host'. " Security Boulevard Malware on IBM Power Systems: What You Need to Know Tripwire Guest Authors Jul 28 Malware – what are the threats? Malware can come from and in a variety of attack vectors. Besides using 'traditional' methods of spreading malware, adversaries can leverage more sophisticated methods to turn your Power System into a 'malware host'. The key target is your data. Data is valuable, and organisations have paid at least $602 […]… Read More The post Malware on IBM Power Systems: What You Need to Know appeared first on The State of Security. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/malware-on-ibm-power-systems-what-you-need-to-know/ Powered by Jetpack

Avast Blog posted: "Earlier this summer, Avast Threat Labs researchers discovered a zero-day vulnerability in Google Chrome when it was utilized in attacks on Avast users in the Middle East. The attacks were highly targeted and, in Lebanon, focused on journalists. The remain" Security Boulevard Candiru: Attack targeting journalists in the Middle East Avast Blog Jul 28 Earlier this summer, Avast Threat Labs researchers discovered a zero-day vulnerability in Google Chrome when it was utilized in attacks on Avast users in the Middle East. The attacks were highly targeted and, in Lebanon, focused on journalists. The remainder of the attacks took place in Turkey, Yemen, and Palestine. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/candiru-attack-targeting-journalists-in-the-middle-east/ Powered by Jetpack

ferrisbuller posted: "Since the beginning of 2022, the Wallarm security research team has been analyzing API vulnerabilities and exploits, and releasing quarterly reports. The Q1 report got a lot of attention and positive feedback from the cybersecurity community, as well as a" Security Boulevard API Vulnerabilities Jump Up 3.7x in Q2-2022 ferrisbuller Jul 28 Since the beginning of 2022, the Wallarm security research team has been analyzing API vulnerabilities and exploits, and releasing quarterly reports. The Q1 report got a lot of attention and positive feedback from the cybersecurity community, as well as a few valuable ideas and suggestions. We included many of these in the Q2 API Vulnerabilities [...] The post API Vulnerabilities Jump Up 3.7x in Q2-2022 appeared first on Wallarm. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/api-vulnerabilities-jump-up-3-7x-in-q2-2022/ Powered by Jetpack

Christian Wiens posted: "The nation's largest Financial Services providers are a favorite target for nation-state sponsored and coordinated cyber-attacks. Despite significantly more financial and resource investment in cybersecurity than any other industry, critical infrastructur" Security Boulevard Customer Case Study: Self-Learning Cyber Defense for Financial Institutions Christian Wiens Jul 28 The nation's largest Financial Services providers are a favorite target for nation-state sponsored and coordinated cyber-attacks. Despite significantly more financial and resource investment in cybersecurity than any other industry, critical infrastructure breaches and novel attacks remain a daily occurrence. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/customer-case-study-self-learning-cyber-defense-for-financial-institutions/ Powered by Jetpack

Editor posted: " Information ecosystems in the modern era are extremely complicated. Large amounts of data must be sent qui" Security Boulevard How to Establish Effective Information System Security Plans Editor Jul 28 Here are 8 steps to create an effective information security plan. Also, learn about the importance and fundamentals of security plans. The post How to Establish Effective Information System Security Plans appeared first on Cyphere | Securing Your Cyber Sphere. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/how-to-establish-effective-information-system-security-plans/ Powered by Jetpack

Curtis Kang posted: " Blogs Blog CVE/NVD Failed to Report and Detail 27.3% of Vulnerabilities in 2022 H1 SHARE THIS: Curtis Kang July 28, 2022 " Security Boulevard CVE/NVD Failed to Report and Detail 27.3% of Vulnerabilities in 2022 H1 Curtis Kang Jul 28 Today, Flashpoint releases the State of Vulnerability Intelligence: 2022 Midyear Edition, a report designed to help organizations understand and properly contextualize the vulnerability landscape. The post CVE/NVD Failed to Report and Detail 27.3% of Vulnerabilities in 2022 H1 appeared first on Flashpoint. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/cve-nvd-failed-to-report-and-detail-27-3-of-vulnerabilities-in-2022-h1/ Powered by Jetpack

brooke.crothers posted: "Do you know how many cert-manager instances your developers are using? Are they all using the latest stable version? brooke.crothers Wed, 07/27/2022 - 16:18 7 views --How do you manage deployment of cert-manager instances when new releases com" Security Boulevard Do you know how many cert-manager instances your developers are using? Are they all using the latest stable version? brooke.crothers Jul 27 Do you know how many cert-manager instances your developers are using? Are they all using the latest stable version? brooke.crothers Wed, 07/27/2022 - 16:18 7 views --How do you manage deployment of cert-manager instances when new releases come out? --How do you view every identity issued from every instance in every cluster? --And how do you manage all platforms on which your Kubernetes clusters could be running? To answer those questions, Jetstack has partnered with Venafi to create Jetstack Secure, a solution that fills in the gaps and provides singular control over any certificate, instance or cluster across any Kubernetes platform. Here's how it works. What gaps does basic cert-manager leave behind? Cert-manager instances ensure certificates are updated – but what updates the instances? First, let's review what cert-manager is meant to do: Automate certificate issuance and renewal, protecting Ingress with TLS Work with Public and private Certificate Authorities (Let'sEncrypt, HashiCorp Vault, Venafi and others) Secure pod-to-pod communication Provide certificates for web-facing and internal workloads Offer cloud-native protection with open-source add-ons for additional security Make sure certificates are valid and up to date: While cert-manager is an effective, general-purpose certificate management controller for Kubernetes, it lacks higher-up oversight to ensure it is using the latest stable version. You can't just set it and forget it – the instances themselves need to be updated upon every new release. And, when you might have clusters running on a multitude of Kubernetes platforms – in the cloud, through a CSP, or in a virtual environment running as OpenShift – how do you ensure the rollout effectively finds and reaches all instances? Do you even know where all instances are? While powerful and effective at deploying and updating the certificates themselves, there are overall management functions cert-manager is not equipped to do: Cert-manger will not automatically update instances to the most recent version. This leaves your team to manually handle deployment of all cert-manger instances as new releases are made available – across whatever platform your Kubernetes clusters may reside. It does not give you visibility into every machine identity (certificate) issued by every instance in every cluster. If you want the full picture, you must hunt down the parts and piece them together. Even if you could get a configuration management database (CMDB) to do the hard work of discovering disparate security resources across your enterprise, the most it will do is provide the data in a report, leaving time-consuming analysis to your team. Cert-manager is only half of the Kubernetes security puzzle. Jetstack Secure now provides the other half. How does Jetstack Secure help? If cert-manager provides Kubernetes the certificates it needs, Jetstack Secure provides the certificate management. Jetstack and Venafi worked together to create a cloud-native solution that would provide control of X.509 configuration across Kubernetes and OpenShift clusters. No more deploying cert-manager instances across multiple platforms and losing track of them. No more being in the dark about which ones are running the most stable version, or manually investigating numerous instances to find the answer - or ignoring the question altogether. With Jetstack Secure, you're able to see critical information like certificate origins, the CA that issued them, their compliance with your corporate policy, and why you may have failed a policy check. With this platform-agnostic solution, you can gain visibility of all deployed certificates in whatever cluster they may be, all from a single control panel. Jetstack Secure provides the way to aggregate, audit and manage machine identities deployed within Kubernetes, and complements, enhances and contextualizes the work of cert-manager. Use Jetstack Secure to: Avoid certificate misconfigurations. Know if any cert-manager deployed in any cluster isn't running the latest version and needs to be upgraded. Have immediate visibility into new clusters as they are onboarded into Jetstack Secure (wherever it's running) as they pop up on the dashboard. In short, a full, live inventory of all cert-manager instances, whether they are running the latest stable version, and what machine identities they provision within your Kubernetes environment. Cert-manager is only as good as the visibility you have into your ecosystem because losing track of any machine identity puts your whole Kubernetes or OpenShift workload at risk. Related Posts Open Source Makes Machine Identities on Kubernetes Accessible for All Google CAS Supports cert-manager and Jetstack Secure for Cloud Native and Private PKI Pulumi Policy-as-Code for cert-manager Simplifies Machine Identity Management Open-Source Community: CNCF Sandbox Accepts Cert-Manager   Anastasios Arampatzis Cloud If you're running Kubernetes or OpenShift, you likely have cert-manager spun up to help you manage the load of installing, deploying and renewing the certificates within your clusters. And we have Jetstack to thank for that. However, you'll need to do more to bridges the gaps. Zero Trust with cert-manager, Istio and Kubernetes. Find out more. "> Off UTM Medium Resources UTM Source Blog UTM Campaign Recommended-Resources Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/do-you-know-how-many-cert-manager-instances-your-developers-are-using-are-they-all-using-the-latest-stable-version/ Powered by Jetpack

Cole Grolmus posted: "Look no further than Verizon's Data Breach Investigations Report for data about the operational side of security — especially incidents and breaches. Now in its 15th (!!!) year, the report is one of the deepest and most comprehensive sources o" Security Boulevard The Strategic Impact of Verizon's 2022 Data Breach Investigations Report Cole Grolmus Jul 27 Analyzing the themes and impact of security incidents and breaches from Verizon's 2022 DBIR. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/the-strategic-impact-of-verizons-2022-data-breach-investigations-report/ Powered by Jetpack

Ashish Jain posted: "In keeping with our commitment to improve attack resilience while keeping user experience at the forefront, we're excited to share Arkose Labs' latest enhancements and efficacy improvements to help our customers stay ahead of today's attackers. As a partn" Security Boulevard What's New with the Arkose Labs Platform: July 2022 Ashish Jain Jul 27 In keeping with our commitment to improve attack resilience while keeping user experience at the forefront, we're excited to share Arkose Labs' latest enhancements and efficacy improvements to help our customers stay ahead of today's attackers. As a partner to numerous Fortune 100 enterprises, Arkose Labs enjoys a unique advantage of witnessing some of the internet's […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/whats-new-with-the-arkose-labs-platform-july-2022/ Powered by Jetpack

Jeff Williams, Co-Founder, Chief Technology Officer posted: " Skip to content " Security Boulevard API inventory: Focusing on runtime code, not never-invoked libraries Jeff Williams, Co-Founder, Chief Technology Officer Jul 27 Part one of the five-part series, Building a modern API security strategy. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/api-inventory-focusing-on-runtime-code-not-never-invoked-libraries/ Powered by Jetpack

Marc Handelman posted: "Our sincere thanks to Security BSides San Francisco for publishing their outstanding conference videos on the organization's YouTube channel. Permalink" Security Boulevard BSidesSF 2022 – Len Noe's 'Biohacker: The Invisible Threat' Marc Handelman Jul 27 Our sincere thanks to Security BSides San Francisco for publishing their outstanding conference videos on the organization's YouTube channel. Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/bsidessf-2022-len-noes-biohacker-the-invisible-threat/ Powered by Jetpack

Ed O'Connell posted: "Technology has dramatically transformed the financial services industry in the last decade, ushering in a new ecosystem of digital payment platforms. A good proof point of this evolution is the rapid growth of payment service Venmo, which processed $159B " Security Boulevard How to Secure Financial Services Applications Ed O'Connell Jul 27 Technology has dramatically transformed the financial services industry in the last decade, ushering in a new ecosystem of digital payment platforms. A good proof point of this evolution is the rapid growth of payment service Venmo, which processed $159B in payments in 2021, a 59% year-over-year increase. Though this growth is remarkable, it isn't the only growth metric we should be concerned about. Consumer and business expectations are also growing considerably as well. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/how-to-secure-financial-services-applications/ Powered by Jetpack

Bolster Research Labs posted: "Today, more than 4.6 billion people are on social media, representing 58.4% of the total human population. Even businesses realize social media's massive potential, with 73% of all small businesses investing time and money on these platforms. As ingr" Security Boulevard The Top 8 Social Media Scams You Need to Watch Out For Bolster Research Labs Jul 27 Social media fraud losses comprised 26% of the total fraud losses reported in 2021. Here are some of the most popular social media scams that have fleeced social media users. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/the-top-8-social-media-scams-you-need-to-watch-out-for/ Powered by Jetpack

Joseph Edwards posted: " An analysis of three in-the-wild payloads delivered using the recently discovered Follina exploit shows how attackers can use it to achieve persistent access in victim environments and turbo-charge efforts to 'live off the land' and avoid detection by s" Security Boulevard Threat analysis: Follina exploit fuels 'live-off-the-land' attacks Joseph Edwards Jul 27 An analysis of three in-the-wild payloads delivered using the recently discovered Follina exploit shows how attackers can use it to achieve persistent access in victim environments and turbo-charge efforts to 'live off the land' and avoid detection by security monitoring tools.  Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/threat-analysis-follina-exploit-fuels-live-off-the-land-attacks/ Powered by Jetpack

Mandy Bachus posted: "There has long been a belief in the manufacturing industry that companies in the sector were relatively safe from cyber threats, with a misconception that cyber attackers prefer to target businesses in the financial services and healthcare industry instea" Security Boulevard The Ultimate Guide to Data Security in the Manufacturing Industry Mandy Bachus Jul 27 There has long been a belief in the manufacturing industry that companies in the sector were relatively safe from cyber threats, with a misconception that cyber attackers prefer to target businesses in the financial services and healthcare industry instead. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/the-ultimate-guide-to-data-security-in-the-manufacturing-industry/ Powered by Jetpack

Axio posted: "The stark reality of today's cybersecurity threat landscape is that the traditional approach to managing risk is insufficient. Security leaders need a process that can drive value quickly and deliver results. Cyber risk quantification (CRQ) has emerged as" Security Boulevard Cyber Risk Quantification Time to Value Axio Jul 27 The stark reality of today's cybersecurity threat landscape is that the traditional approach to managing risk is insufficient. Security leaders need a process that can drive value quickly and deliver results. Cyber risk quantification (CRQ) has emerged as a leading approach to many cybersecurity programs within the past few years. At Axio, we believe that... Read article > The post Cyber Risk Quantification Time to Value appeared first on Axio. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/cyber-risk-quantification-time-to-value/ Powered by Jetpack

Cybereason Team posted: " Learn how ransomware behaves so you can better defend against it. Ransomware operations have transformed dramatically over the last few years from a small cottage industry conducting largely nuisance attacks to a highly complex business model tha" Security Boulevard Webinar August 11th 2022: Ransomware Labs Cybereason Team Jul 27 Learn how ransomware behaves so you can better defend against it. Ransomware operations have transformed dramatically over the last few years from a small cottage industry conducting largely nuisance attacks to a highly complex business model that is extremely efficient and specialized with an increasing level of innovation and technical sophistication. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1932594 Powered by Jetpack

Shelley Leveson, Director of Content Marketing, HYPR posted: "As the most targeted industry for attacks, and one of the most closely watched by regulators, financial organizations are generally fierce proponents of cybersecurity innovation. Yet we continue to hear about attacks that circumvent the protocols guarding" Security Boulevard Authentication Security in the Finance Industry: 2022 Report | HYPR Shelley Leveson, Director of Content Marketing, HYPR Jul 27 As the most targeted industry for attacks, and one of the most closely watched by regulators, financial organizations are generally fierce proponents of cybersecurity innovation. Yet we continue to hear about attacks that circumvent the protocols guarding authentication and access to financial institution services and systems. Just last month, Flagstar Bank announced that hackers gained unauthorized access to their networks and more than 1.5 million customer records. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/authentication-security-in-the-finance-industry-2022-report-hypr/ Powered by Jetpack

Marc Handelman posted: " via the inimitable Daniel Stori, crafting superb comics" Security Boulevard Daniel Stori's 'commit messages' Marc Handelman Jul 27 via the inimitable Daniel Stori, crafting superb comics at turnoff.us! Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/daniel-storis-commit-messages/ Powered by Jetpack

Jeff B. Copeland posted: "On July 22, 2022, T-Mobile agreed to settle the class action suit brought on behalf of 76 million customers whose PII was stolen in a data breach in 2021. Under the terms of the settlement, the cellphone carrier would pay $350 million on claims by class m" Security Boulevard RiskLens Fast Facts on Cyber Risk in the Telecommunications Industry Jeff B. Copeland Jul 27 On July 22, 2022, T-Mobile agreed to settle the class action suit brought on behalf of 76 million customers whose PII was stolen in a data breach in 2021. Under the terms of the settlement, the cellphone carrier would pay $350 million on claims by class members and their attorneys. The plaintiffs could be paid up to $25,000 for out-of-pocket losses and $25 an hour for their time dealing with those losses, and receive two years of identity theft protection services. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/risklens-fast-facts-on-cyber-risk-in-the-telecommunications-industry/ Powered by Jetpack

Aharon Fridman posted: "AWS recently announced a new revolutionary Identity and Access Management (IAM) feature - IAM Roles Anywhere. This feature allows workloads (or any certificate holding entity, for that matter) outside the AWS account (on-prem or in other clouds), to assum" Security Boulevard AWS IAM Roles Anywhere ~ IAM Risks Anywhere? Aharon Fridman Jul 27 AWS recently announced a new revolutionary Identity and Access Management (IAM) feature - IAM Roles Anywhere. This feature allows workloads (or any certificate holding entity, for that matter) outside the AWS account (on-prem or in other clouds), to assume a role (obtain temporary credentials for a role) in your AWS account and access AWS resources. While this feature presents a significant improvement in management of external access to AWS resources, it also presents security challenges; and unless done correctly; could potentially reduce the governance and manageability of your workload's identities. How does it work? Prior to this feature, an on-premises server could access an S3 bucket in an AWS account, for example, by creating an IAM user in the AWS account, creating access keys for that IAM user, and placing the keys on the on-premises server. It is considered bad practice to use access keys to identify workloads for a variety of reasons, including: Access keys can be forgotten and leaked There is no visibility into who is the entity using these keys They require regular rotation In comes Roles Anywhere To simplify; this feature relies on a CA (Certificate Authority) that issues certificates to your workloads confirming they are recognized by the CA. Inside AWS, you create a Trust Anchor, which is basically telling AWS "this is my CA, which I trust to authenticate my workloads." Additionally, you create "profiles" that are collections of roles that can be assumed, once you are trusted by this trust anchor. When a workload wants to access an AWS resource, let's say, the S3 bucket above, it presents AWS with its certificate signed by the CA and signs the request with its private key. If the certificate is valid, AWS will return the temporary credentials for that role to the calling workload. IAM Roles Anywhere (Courtesy AWS Identity): Modification to a role's trust policy Any role that would be assumed by workloads using Roles Anywhere should trust the "rolesanywhere" service by adding the rolesanywhere service to its trust policy. The following trust policy example presents the minimum requirement in a role's trust policy, for the role to partake in Roles Anywhere: How to distinguish between workloads Workloads can be distinguished by the Organizational Unit (OU) and Subject Common Name (CN) in the certificate. Both, the CN and OU are available in the aws:principalTag key to be used as a condition in the role's trust policy. In the example above, if this role should only be assumed by a workload named "pipeline.prod" - the CA would issue the workload a certificate with CN = "pipeline.prod" and the role's trust policy should include the following condition: Security implications One of the biggest challenges in managing IAM in the cloud is answering the question - who can access my cloud? Put differently: Where are my identities? In any cloud environment, the identities are a mix of IAM users, workloads, externally assumed roles, and federated identities. While the need to eliminate usage of IAM users and access keys is clear, the goal should be to reduce complexity, rather than increasing it. The combination of CA and condition keys in rolesanywhere renders them as a cloud identity store, where your identities hide in the CN as defined by the CA and enforced by your condition keys. Imagine a cloud security admin trying to figure out, "who can assume this role from the internet?" going through multiple complex JSON objects of trust policies and chasing the CA config to map the workload assuming the role and accessing the data. To put it in another way, condition keys are hardly where you want to manage your identities that can access your account from the internet. In terms of blast radius management, once rolesanywhere is used in the environment, a compromised CA means a compromised AWS environment, which is non-trivial. In addition, some non-trivial configuration gaps one should be aware of, when deploying this service: While the CN is available as a condition key in the role's trust policy, its usage is not enforced. One could add the rolesanywhere service to the trust policy without any conditions, meaning any entity that presents a valid certificate from the trusted CA could assume the role. Multiple CN strings can be added to the condition of a trust policy, violating the separation of duties and least-privileged approach. The same role can trust rolesanywhere as well as other identities; hence be assumed by the rolesanywhere service and other entities in parallel, creating yet another complexity layer. Source IP of the workload cannot be used in the condition keys of neither the trust policy nor the attached permission policies (While they are available when using access keys and an IAM User). This is because the IP in the request context is set as the caller service (rolesanywhere). If the workload's IP could be passed in the request context, that could add a significant layer of control. Best practices and recommendations The following best practices are built in and supported by Zscaler's Posture Control, CNAPP platform: Designate dedicated roles to be assumed via rolesanywhere; do not reuse existing roles that are assumed outside rolesanywhere Designate a single role per workload Group similar workloads into rolesanywhere profiles for better manageability Use session policies in the profile to control the blast radius of a compromise. For example, use the session policies to Deny deletion of S3 Buckets and database instances Deny any IAM action Limit the actions to the relevant services Use CN and OU in a format that aligns with org naming conventions and enables accountability To learn more about Posture Control, schedule a demo or contact us. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/aws-iam-roles-anywhere-iam-risks-anywhere/ Powered by Jetpack

Marc Handelman posted: "Our sincere thanks to Security BSides San Francisco for publishing their outstanding conference videos on the organization's YouTube channel. Permalink" Security Boulevard BSidesSF 2022 – Brad Richardson's And Madhav Bhatt's 'So You Think You Can Secure Your Cloud : Red Team Engagements In GCP' Marc Handelman Jul 27 Our sincere thanks to Security BSides San Francisco for publishing their outstanding conference videos on the organization's YouTube channel. Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/bsidessf-2022-brad-richardsons-and-madhav-bhatts-so-you-think-you-can-secure-your-cloud-red-team-engagements-in-gcp/ Powered by Jetpack

The Security Skeptic posted: "My colleagues and I at Interisle have created a YouTube channel to complement the quarterly reporting and studies of cybercrime we host at the Cybercrime Information Center. Our goal is to share, in a few minutes, the findings and insights from our resear" Security Boulevard Cybercrime Information Center's YouTube Channel The Security Skeptic Jul 27 My colleagues and I at Interisle have created a YouTube channel to complement the quarterly reporting and studies of cybercrime we host at the Cybercrime Information Center. Our goal is to share, in a few minutes, the findings and insights from our research in a format that's easily accessible and shareable, informative, and entertaining. The inaugural videos provide 2-5 minute summaries of our annual Phishing and Malware Landscape studies. We'll continue to produce videos of our annual studies. If you like what you see, leave us a comment. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1932536 Powered by Jetpack

Tom Holz posted: " Contact Sales [email protected] +1-216-931-0465 IIoT Balancing Security and Interconnectivity in the Manufacturing Industry July 27,2022 Home " Security Boulevard Balancing Security and Interconnectivity in the Manufacturing Industry Tom Holz Jul 27 Operations in the manufacturing industry used to be siloed according to location, with security focused on restricting physical access to machinery. But those days are long gone, as machines are increasingly run by software and automated processes. The post Balancing Security and Interconnectivity in the Manufacturing Industry appeared first on Keyfactor. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/balancing-security-and-interconnectivity-in-the-manufacturing-industry/ Powered by Jetpack

Anthony M. Freed posted: " Ransomware has transformed significantly over the past several years, and it is forcing security to evolve with it. These complex and highly targeted ransomware operations–or RansomOps–seek to infiltrate entire networks in order to extort multi-" Security Boulevard Five of the Most Advanced RansomOps Gangs Anthony M. Freed Jul 27 Ransomware has transformed significantly over the past several years, and it is forcing security to evolve with it. These complex and highly targeted ransomware operations–or RansomOps–seek to infiltrate entire networks in order to extort multi-million dollar ransoms from targets. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1932545 Powered by Jetpack

Tom Kopchak posted: "With the introduction of Splunk Enterprise 9.0, Splunk has changed the language used for certain directories in indexer-clustering. Let's explore how this works in practice. Some history and background In versions of Splunk prior to 9.0, the configuration" Security Boulevard Exploring the Directory Naming Change in Splunk Enterprise 9.0 Indexer Clustering Tom Kopchak Jul 27 With the introduction of Splunk Enterprise 9.0, Splunk has changed the language used for certain directories in indexer-clustering. Let's explore how this works in practice. Some history and background In versions of Splunk prior to 9.0, the configurations that would be sent to the indexers would be stored in the $SPLUNK_HOME/etc/master-apps directory on the [...] The post Exploring the Directory Naming Change in Splunk Enterprise 9.0 Indexer Clustering appeared first on Hurricane Labs. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/exploring-the-directory-naming-change-in-splunk-enterprise-9-0-indexer-clustering/ Powered by Jetpack

Christopher Burgess posted: "The International Consortium of Investigative Journalists (ICIJ), in conjunction with a number of worldwide publications, jointly released an ICIJ investigation, "The Uber Files" which detailed the back room deals and access enjoyed by the company as it w" Security Boulevard Uber's Latest Shenanigans Christopher Burgess Jul 27 The International Consortium of Investigative Journalists (ICIJ), in conjunction with a number of worldwide publications, jointly released an ICIJ investigation, "The Uber Files" which detailed the back room deals and access enjoyed by the company as it went about its "chaotic global expansion." The source of the Uber Files has been identified as Mark MacGann, […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/ubers-latest-shenanigans/ Powered by Jetpack

Lisa O'Reilly posted: "With the demands of the modern workforce, there's been an increased use of native cloud email protection, like Microsoft 365, in the last 12 months. This has led many security professionals to ask if Microsoft 365 Defender can provide enough threat " Security Boulevard Expert Guide to Microsoft 365 Email Threat Protection Lisa O'Reilly Jul 27 With the demands of the modern workforce, there's been an increased use of native cloud email protection, like Microsoft 365, in the last 12 months. This has led many security professionals to ask if Microsoft 365 Defender can provide enough threat coverage to protect their organization. They wonder if they need advanced detection such as […] The post Expert Guide to Microsoft 365 Email Threat Protection first appeared on SlashNext. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/expert-guide-to-microsoft-365-email-threat-protection/ Powered by Jetpack

Oguzhan Ozdemir posted: " Thundra Blog Subscribe Get Thundra Free × SUBSCRIBE TO OUR BLOG Get our new blogs delivered straight to your inbox.   Subscribe THANKS FOR SIGNING UP! We'll make sure to share the best materials crafted for you! " Security Boulevard Differences between logging and distributed tracing Oguzhan Ozdemir Jul 27 If you work in modern software development, you probably deploy something to the cloud. These cloud deployments often lead to adopting a microservice architecture, because it enables developers to integrate cloud services more efficiently and, in turn, save time and money. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/differences-between-logging-and-distributed-tracing/ Powered by Jetpack

Grainne McKeever posted: "Imperva is reaching new heights as we expand our global network of data centers with new points of presence (PoPs) in Rio de Janeiro, Brazil and Cape Town, South Africa. The two cities, often compared to each other for their many similarities including th" Security Boulevard Imperva Reaches New Heights as it Opens PoPs in Cape Town and Rio Grainne McKeever Jul 27 Imperva is reaching new heights as we expand our global network of data centers with new points of presence (PoPs) in Rio de Janeiro, Brazil and Cape Town, South Africa. The two cities, often compared to each other for their many similarities including their breathtaking coastlines, white sandy beaches and mountains sweeping down to the […] The post Imperva Reaches New Heights as it Opens PoPs in Cape Town and Rio appeared first on Blog. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/imperva-reaches-new-heights-as-it-opens-pops-in-cape-town-and-rio/ Powered by Jetpack