Automation

Cloud Security This Week – October 20, 2017

Everything about cyberattacks are insidious, but two significant attacks reported this week highlight just how hard it...

Cloud Security This Week – September 15, 2017

The impact of the Equifax breach started to sink in among the 143 million people who were affected, and ElasticSearch...

Cloud Security and Automated Incident Response

Fixing stuff isn’t as interesting as breaking stuff, and this even applies in the realm of the cloud. Perhaps...

Cloud Security Fitness Guide – Exercise #10: Watch World-Readable and Listable S3 Bucket Policies

S3 has been around for quite some time. It may be the oldest Service in the ever expanding Web Services provided by...

Cloud Security Fitness Guide – Exercise #9: Do Not Allow 0.0.0.0/0 Unless You Mean It

In the last post, John Martinez wrote about how Autoscaling can help an application deployed on AWS survive an attack....

Cloud Security Fitness Guide – Exercise #8: Use AutoScaling to Dampen DDoS Effects

 We’re switching the series up a little bit and going to pay some attention to the network layer for a couple of...

Cloud Security Fitness Guide – Exercise #6: Rotate all the Keys Regularly

In the previous article, we had a pretty deep discussion on how and why to limit privilege in the AWS IAM service....

Cloud Security Fitness Guide – Exercise #7: Use IAM Roles with STS AssumeRole

We are more than half way through the top ten, so let's finish up the IAM discussion before jumping into some of the top...

Cloud Security Fitness Guide – Exercise #4: Use Roles for EC2

By now, you're getting the theme that security on AWS is all about being proactive. The point of proactive security is...

Cloud Security Fitness Guide – Exercise #3: Reduce IAM Users with Admin Rights

Based on the last two posts, you have disabled your AWS root user; removed any root keys, assigned an MFA to that user,...

Cloud Security Fitness Guide – Exercise #2: Enable MFA Tokens Everywhere

Here we are, a week later and now following up on to the second installment of our recommended Top Ten Security Best...

Cloud Security Fitness Guide – Exercise #1: Disable Root Account API Access Key

Today, we kick off a series on the top 10 security best practices we've come across based on our own experiences. As AWS...