MiguelHzBz
Re:Ask HN: Why is so hard to apply the least privilege principle in IA...
on Tuesday March 14, 2023 @09:50AM (#35151495)
IMO, there is no simple answer, since many access control elements are involved and implementations vary between organizations.
From my experience I would say that there may be different factors:
- Every developer is an exception
- IAM is challenging to scale
- Lazy IT Teams?
- Visibility of access controls are poor
Some useful references:
- https://sysdig.com/blog/identity-access-management-difficult...
- https://www.effectiveiam.com/why-aws-iam-is-so-hard-to-use
- https://aws.amazon.com/blogs/security/iam-access-analyzer-ma...
Offensive AI Compilation
Incidence response in GCP: Forensic artifacts
OWASP Kubernetes Top – Tools and Techniques
Overcoming Developer Fatigue: Strategies for Streamlining Vulnerability Fixes
CVE-2023-0210 – Linux Kernel Unauthenticated Remote Heap Overflow Within Ksmbd
Incident Response Methodologies 2022 – Cert
Extortion in Cloud Storage
Tales from the Kernel Parameter Side
Cryptomining campaign abuses free-tier cloud dev resources
GitHub Actions are being abused to run mining operations
CVE-2022-42889 Explotation, Detection and Mitigation
Sysdig 2022 Threat Cloud-native threats are increasing and maturing
AWS Security Best Practices to Adopt in Production
SBOM 101 – All the questions you were afraid to ask Software Bill of Materials
Kubernetes 1.25 will be out next week – List of new features and deprecations
Cryptominer detection: a Machine Learning approach
Crypto Miner detection: a machine learning approach
Facebook's AI Chatbot: ‘Since Deleting Facebook My Life Has Been Much Better’
One Vulnerable Jenkins Server, That's All They Need
Pentester's Promiscuous Notebook
Lapsus$ incident was a brilliant zero trust demonstration said Okta
Re:Secure SSH on EC2: What are the real threats?
on Tuesday June 14, 2022 @01:07PM (#31742522)
That's the point of the article. If you have the default EC2 configuration, exposed SSH is not such a critical issue. That might be simple, but sometimes we follow best practices without understanding why we follow them.