nutbear

6 ms·

1.
Authorization Bypass in AWS's Agentic AI for Enterprise: Amazon Quick(fogsecurity.io)
2 points by nutbear 4mo ago|0 comments
2.
by nutbear 3y ago
Good catch on the bucket vs object level permissions with S3 and s3:PutObject. I'd also be curious for future plans with resource policies as that's another layer of complexity to manage - where the resource policy would manage ac
3.
by nutbear 3y ago
Yes. Good points. Agreed with patchwork as sometimes IAM can take a backseat to different priorities such as application development or feature development. There's a couple different models for IAM ownership. At some places, the app
4.
by nutbear 3y ago
IAM Policies in AWS are inherently difficult - there's a lot of nuance to the policies such as evaluation logic (allow/deny decisions), resource scoping, conditionals, and more. It's often more straightforward to start with a
5.
by nutbear 3y ago
I wrote a blog detailing what this change means on S3 ACLs and Block Public Access on by default: https://www.cloudquery.io/blog/finding-enabled-s3-acls-and-d...
6.
Cisco Announces Intent to Acquire Lightspin (Cloud Security)(blogs.cisco.com)
1 points by nutbear 3y ago|0 comments
7.
Outdated by Default: AWS IAM Policy Language Version and Legacy Evaluation Logic(cloudquery.io)
2 points by nutbear 4y ago|0 comments
8.
by nutbear 4y ago
We wrote a post on this and some of the nuances/discrepancies for these S3 settings: https://www.cloudquery.io/blog/finding-enabled-s3-acls-and-d...
9.
by nutbear 4y ago
Thanks for sharing your story! A decent amount of disclosure programs explicitly call out social engineering as unacceptable conduct and submissions. However, social engineering is a very valid method for attackers and in many cases, offers
10.
Uncontrollable AWS IAM: Sts:GetSessionToken, GetCallerIdentity, and Policy Sim(praetorian.com)
2 points by nutbear 4y ago|0 comments
11.
Shared VPCs in AWS(aws.amazon.com)
4 points by nutbear 8y ago|0 comments