skuenzli

It looks to me like the skill sets up a connection to their MCP server at api.ensue-network.ai during Claude session start via https://github.com/mutable-state-inc/ensue-skill/blob/main/s...

Then Claude uses the MCP tools according to the SKILL definition: https://github.com/mutable-state-inc/ensue-skill/blob/main/s...

This is the motivating example I was looking for on the readme: a client making a request and an agent handling it using the MCP. Along with a log of the agent reasoning its way to the answer.

Thank you - that's helpful.

Thank you - I appreciate the background.

I'll reach out to the email address in your profile.

Do you have any suggestions for finding firm or attorney that can help with immigration of health care workers, specifically nurses?

I have a friend searching for such a firm now and of the ~15 firms contacted none had any experience with health care immigration.

They have decades of experience with IT services and the path to H1-B for IT.

If no suggestions, can you share thoughts on why healthcare immigration attorney help seems to be difficult to find?

Dumping audit reports with a sea of red on delivery teams for things largely low-risk in reality and out of their control rarely does any good.

I'm not up on EKS-ELB these days, but if the nodes only allow ingress to NodePorts from the ELB, then it seems like those findings should be suppressed in most orgs.

If the SecEng team was partnering with the delivery team they'd know that before sending the report.

Thanks for the additional context.

Agree that leaders should definitely be ready to motivate stakeholders and collaborating teams to act on this kind of info before spending significant time gathering & producing it.

Can you share what the high-level goal of the project was?

i.e. was the VP trying to reduce risk? scale out responsibility for managing access?

I love this approach to integrating access control workflow into existing workflows using code.

Really feels like security can actually be "everyone's job" when you're able to make good access management decisions from within your existing tools and their supporting context.

Thanks for the feedback!

re Problem Awareness

I agree being aware that your security policy doesn't do what you think it does is definitely a problem. We're working on that too with reports of your actual, effective access and educational materials.

Let's illustrate this problem with an example. Many people don't realize the problems around using IAM policies with wildcard resource conditions. This results in incidents like a role for a firewall application having access to unrelated data for a credit application.

A principal (IAM user or role) with an IAM security policy that allows calling an api action like `s3:GetObject` to all resources means that principal can access objects inside any bucket within the AWS account by default.

This DenyEveryoneElse statement: https://github.com/k9securityio/tf_s3_bucket/blob/master/exa...

prevents access by unauthorized principals at the bucket level.

re Migration

There are at least two ways to migrate to this module:

First, if you are already using Terraform and want to try out a better bucket policy, you can use the policy submodule directly. This is described in the README and demonstrated in the tests: https://github.com/k9securityio/tf_s3_bucket/blob/master/tes...

Second, if you want to migrate an existing bucket into this Terraform module, you can use `terraform import` or `terraform mv` to migrate the AWS bucket resource into a new Terraform module definition.

I'd be happy to speak with you and anyone else about AWS security problems. Contact info in profile.

(Author & k9 Security Founder)

Thanks for taking a look at our Terraform module designed to help Cloud teams protect data in AWS S3, quickly and confidently. Feedback appreciated :)

We are trying to improve the usability of Cloud security.

Specifically, we've heard that the AWS security model is too complex and difficult to validate.

Configuring a least privilege bucket policy is amongst the most difficult AWS security challenges and a problem we're trying to solve for non-security experts.

Do you feel like this module makes it easy to understand what access the author intends to grant? What makes that difficult?

Thanks!

Stephen

(Author) The `riskquant` tool is really cool and the library is even cooler. I'm excited that tech folks are starting to quantify risks for their quickly changing systems.

Risk management in tech/cybersecurity is really immature compared to other domains like structural engineering (earthquakes), finance (portfolio risk position), or environmental health and safety.

riskquant and similar tools do the critical work of making proven risk analysis methods accessible in delivery pipelines and deployment platforms for inclusion in continuous risk monitoring systems and scaling periodic risk analysis activities.

Thanks Jay, that means a lot coming from you. I hope we get to build great things together again some day.

You're welcome! Thank you for sharing that; it means a lot because that's precisely the kind of help I'm trying to provide. I wish you success in the New Year and your career.

(Author)

> playing the game well is now front and center

As it always has been and ever shall be :)

I agree that social and communication skills are incredibly important in groups and generally more important than technical skills outside of deep specialties.

One of the key points of the post is:

> Developing your thoughts and a clear position in a written form that you are comfortable with people reading and using as the basis of a discussion is a terrific quality bar for those thoughts.

The more you develop your thoughts and position, the better you'll be able to play the game in a discussion or another forum. You and your colleagues can win through deeper understanding of customers & stakeholders, the problem, and solution space. I expect your colleagues will recognize that expertise and understanding even if they don't want to admit their position is 'wrong.'

Of course understanding the landscape and the 'right' move does not guarantee success. You still need to influence decision makers to give it a shot, and then you'll see whether the idea works or not.

I learned a lot about how to do this from books like 'How to Win Friends and Influence People', Influencer (Grenny), and 'Getting More' (Diamond) I also benefited tremendously from an 2-day workshop on public speaking.

There's nothing like doing this where the outcomes matter and it's a challenge for your current skills. So in addition to the publishing challenges outlined in the post, you can develop your ability to influence by:

Changing some minds

Present your ideas at user groups and conferences. You can ground the talk in material you an expert in and/or written about, but the important bit is to practice developing and communicating a point of view that influences people in some way: challenge 'conventional wisdom' or help people understand when to use or not use 'Best Practice'. My colleague Bob Lalasz has an _excellent_ series on developing a point of view: https://scienceplusstory.com/tag/pov/

Changing your org

Plan and execute some change within your team or organization, scaling up the ladder of "we don't do X" until you're satisfied. I recommend starting with small numbers of people/HiPPOs: convince the one or two engineers you're working with to adopt unit testing or static analysis for this one project to see how it goes, then convince the team to try continuous improvement via retrospectives and 20% allocation to improve daily work. And work your way up.

I don't know if this counts as 'playing the game,' though I do think developing and executing strategy is fun.

I mostly think of these practices as making things better for myself, colleagues, and customers.