Houston

@patrick.risky.biz seriously, more holiday. You come back on fire! Love the Spice this week!

Trust Issues: What Do All these JSON files actually mean? YouTube video by fwd:cloudsec

Two interesting open-source tools for AWS IAM discussed at @fwdcloudsec.org .
- David Kerber with iam.cloudcopilot.io
www.youtube.com/watch?v=j0YT...
- Nick Siow with nsiow.github.io/yams/
www.youtube.com/watch?v=nkLN...

The most intimidating level of confidence has to be “iPhone without a case” — Otherworldly

There's still time to apply for our scholarship which aims to give students or career changers a ticket and travel stipend to attend fwd:cloudsec Europe in Berlin, this September!

Details here: fwdcloudsec.org/assets/docs/...

Mark your calendar: fwd:cloudsec Europe 2025 lights up Berlin on September 15-16!

This two-day event is a non-profit cloud security conference, and we expect over 350 attendees this year!

Stoked to see this carried forward and thank you to Common Fate!

Tres puntos like …

Don’t Security Engineer Asymmetric Workloads The best way to keep up with cybersecurity research. Join >90,000 security professionals getting the best tools, talks, and resources right in their inbox for free.

Quick shout out to this excellent piece of work by @ramimac.me

tldrsec.com/p/dont-secur...

I was looking into how organizations deploy Spring Boot Actuator in the cloud and found 1 in 4 exposed Actuators had security flaws leading to data leaks or RCE. These risks are more common than you'd think..⚠️

Same as yours!

Mine said Nvidia on the tag!

Did yours also have an oddly named (dangling) tag with an incorrect size? Nvidia, intoxicated elves or something like that :). Was like icing on the cake of the best ugly sweater I have seen in Years. My teens were absolutely horrified!

I suffer from the same “everyone already knows this, right?” Syndrome that keeps 99% of my tips / lessons learned unpublished. I am working to eliminate those thoughts.

I am not complaining about RCPs, they are awesome and long over due. But, the core component we need is a variable for SourceVPC to tie to the orgID of the VPC or VPCe that the traffic traverses. Then Data Perimeter’s core business value can scale with modern massive multi-account environments

State of Cloud Security For our 2024 report, we analyzed data from thousands of organizations to understand the latest trends in cloud security posture.

The latest Datadog State of Cloud Security report was just released! See the key cloud concerns highled by @christophetd.fr
www.datadoghq.com/state-of-clo...