InfoQ Homepage Cloud Security Content on InfoQ
-
Bridgecrew's Yor Provides Automated Tagging for Infrastructure as Code
Bridgecrew recently released Yor, their open-source tool for automated infrastructure as code tagging. Yor automatically adds tags to infrastructure configurations which are then applied to the running cloud resources, simplifying connecting the active resources back to the code that created them. Yor currently supports Terraform, CloudFormation, and Serverless.
-
Aqua Security's Latest Report Highlights Increase in Cloud Attacks
Aqua Security published a report outlining their analysis of a year's worth of security remediation data. This report found that nearly no organization addressed all identified issues with enterprise organizations taking on average 88 days to resolve the issues they do address. Their analysis found a large increase in attacks against container-based and cloud-native infrastructure.
-
New Exploit Breaks Current Spectre Defenses; Fixes Hard without Performance Impact
Researchers from the University of Virginia School of Engineering recently disclosed a new Spectre hardware exploit that can steal secrets via Intel/AMD micro-op caches and circumvents current Spectre defenses. Intel and AMD say no new guidance is needed. Researchers say suggested fixes are inconvenient to deploy or have performance drawbacks.
-
Infosec Teams Expand Use of Security Tools to Address Cloud Complexity, Survey Finds
The Cloud Security Alliance (CSA), a non-profit organization, recently published its findings on the state of cloud security practices which shows accelerating cloud adoption, but a need for more sophisticated security approaches.
-
Infrastructure Vulnerability Scanner Checkov Adds Context Aware Assessments
Bridgecrew has announced the first 2.x version of Checkov. Checkov is an open-source scanner for infrastructure as code (IaC). The 2.0 release includes a re-architected backend that is now graph-based allowing for better processing of multi-resource queries. There has also been an increase in coverage with the addition of nearly 250 new policies.
-
Netflix Open Sources ConsoleMe to Manage Permissions and Access on AWS
Netflix has recently open-sourced ConsoleMe, a AWS multi-account management service, and its CLI utility, Weep. The tools provide a central control plane for permissions management across all of AWS accounts of an organization and help to implement the principle of least privilege.
-
GitHub Changes Token Format to Improve Identifiability, Secret Scanning, and Entropy
GitHub has recently moved to a new format for all of its tokens, including personal access, OAuth access, user-to-server and server-to-server, and refresh tokens. As GitHub engineer Heather Harvey explains, the new format aims to make tokens more easily identifiable, including when scanning repos for secrets, and to increase their entropy.
-
HashiCorp Announces the General Availability of HCP Vault on AWS
Recently, HashiCorp announced the general availability of their fully-managed Vault service for AWS environments on the HashiCorp Cloud Platform (HCP). With Vault, customers can leverage a SaaS service with secret management and encryption capabilities.
-
AWS and Cloudflare Add Bot Management Features to Their Firewalls
Both AWS and Cloudflare have released new bot mitigation features into their respective firewall products. Both releases provide additional features for filtering out unwanted bot traffic from reaching the application.
-
Two Hidden Instructions Discovered in Intel CPUs Enable Microcode Modification
Security researchers Mark Ermolov, Dmitry Sklyarov, and Maxim Goryachy discovered two undocumented x86 instructions that can be used to modify the CPU microcode. The instructions can only be executed when the CPU runs in debug mode, which makes them not easily exploitable, though.
-
Cloudflare Announces New Web Application Firewall
Cloudflare has recently introduced a new Web Application Firewall. The latest engine is written in Rust, provides better performances and integrates with other Cloudflare products.
-
Google Cloud Releases Its Healthcare Consent Management API to General Availability
Google Cloud recently announced it would release its Healthcare Consent Management API to general availability to provide healthcare application developers and clinical researchers a simple way to manage individuals' consent over health data use. The Healthcare Consent Management API is part of the Cloud Healthcare API offering on the Google Cloud Platform (GCP).
-
Microsoft Releases Azure AD My App and New Risk Detections for Identity Protection into GA
Microsoft recently released a few new Azure Active Directory (AD) features, namely My Apps "collections" and new "risk detections" capabilities, into general availability (GA). With these features, the company intends to simplifying identity and access management while also enhancing the customization and controls.
-
Microsoft Releases Azure Attestation into General Availability
Microsoft recently announced the general availability of Azure Attestation, a unified solution for remotely verifying the trustworthiness of a platform and the integrity of the binaries running inside it.
-
Microsoft Releases Azure Firewall Premium in Public Preview
Microsoft Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. The company recently announced a preview release of a premium version of the cloud-based network security service.
CONTENT IN THIS BOX PROVIDED BY OUR SPONSOR
Featured Content
Teleport 6.0 Brings Identity-aware Access to Databases behind NAT
If you have PostgreSQL databases running behind NAT in multiple environments, this release of Teleport is worth downloading. Learn more.
Modern SSH Key Management
SSH key management is obsolete: introducing a better way to set up short-lived SSH credentials. Learn More.
SSH Certificates HOWTO
How to set up certificate-based SSH authentication with single sign-on (SSO) and 2FA. Learn More.