A Review of the Best News of the Week on Cloud Security, DevOps, AppSec
What You Need to Know: AWS Monitoring, Logging, & Alerting (DisruptOps, Jan 19 2020)
“The inspiration for this post is actually a series of misunderstandings I had myself on how things worked, despite years of aws security experience and testing. Largely because I made the mistake of reading the ****ing manual (no, “near real time” for a security event is not 15 minutes).”
Microsoft Application Inspector: Check open source components for unwanted features (Help Net Security, Jan 17 2020)
Want to know what’s in an open source software component before you use it? Microsoft Application Inspector will tell you what it does and spots potentially unwanted features – or backdoors.
Snyk snags $150M investment as its valuation surpasses $1B (TechCrunch, Jan 21 2020)
Snyk, the company that wants to help developers secure their code as part of the development process, announced a $150 million investment today. The company indicated the investment brings its valuation to more than $1 billion (although it did not share the exact figure).
Filter Out the Noise
Since I started this curated newsletter in June 2017, I’ve clipped ~13,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share today’s post on Twitter Facebook LinkedIn
Why multicloud security is your next big challenge (Network World Security, Jan 16 2020)
Companies deploy an average of three to five different cloud services. With an increased emphasis on security and regulatory compliance, the capability to manage these disparate systems is crucial.
FireEye Buys Cloudvisory (Dark Reading, Jan 21 2020)
The purchase is intended to bring new cloud capabilities to the FireEye Helix security platform.
Internet Security Notification – Department of Homeland Security Alert AA20-006A (AWS Security Blog, Jan 16 2020)
On January 6, 2020, the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) released an alert (AA20-006A) that highlighted measures for critical infrastructure to prepare for information security risks, but which are also relevant to all organizations. The CISA alert focuses on vulnerability mitigation and incident preparation.
Introducing Google Cloud’s Secret Manager (Google Cloud Blog, Jan 22 2020)
“Secret Manager is a new Google Cloud service that provides a secure and convenient method for storing API keys, passwords, certificates, and other sensitive data. Secret Manager provides a central place and single source of truth to manage, access, and audit secrets across Google Cloud.’
Container security requires continuous security in new DevSecOps models (Help Net Security, Jan 22 2020)
When Jordan Liggitt at Google posted details of a serious Kubernetes vulnerability in November 2018, it was a wake-up call for security teams ignoring the risks that came with adopting a cloud-native infrastructure without putting security at the heart of the whole endeavor.
Secure DevOps Company Sysdig Raises $70 Million (SecurityWeek, Jan 22 2020)
California-based secure DevOps company Sysdig on Wednesday announced that it raised $70 million in a Series E funding round, which it plans on using to fuel global expansion, including through significant investments in sales and marketing.
52 hackers participate in ninth U.S. Department of Defense and HackerOne bug bounty program (Help Net Security, Jan 16 2020)
Through partnership with the Defense Digital Service, the U.S. Department of Defense (DoD) and HackerOne, the number one hacker-powered pentesting and bug bounty platform, announced the results of the second Army bug bounty program, ‘Hack the Army 2.0’.
Hardcoded SSH Key Found in Fortinet SIEM Appliances (SecurityWeek, Jan 20 2020)
A hardcoded SSH public key in Fortinet’s Security Information and Event Management FortiSIEM can be abused to access the FortiSIEM Supervisor.
Source Code Released for All ProtonVPN Apps (SecurityWeek, Jan 22 2020)
Proton Technologies, the company best known for its privacy-focused email service ProtonMail, this week announced that the source code for all of its ProtonVPN virtual private network (VPN) applications has been made public after each app underwent independent security audits.