A Review of the Best News of the Week on Cloud Security, DevOps, AppSec
COVID-19: Cloud Threat Landscape (Palo Alto Unit42, May 05 2020)
Unit 42 researchers found 56,200+ of the newly registered domain (NRD) are hosted in one of the top four popular cloud service providers (CSPs), such as Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), and Alibaba:
70.1% in AWS
24.6% in GCP
5.3% in Azure
<.1% in Alibaba
Google announces cull of low-quality, misleading Chrome extensions (Help Net Security, Apr 30 2020)
With Google Chrome being by far the most widely used web browser, Google must constantly tweak protections, rules and policies to keep malicious, unhelpful and otherwise potentially unwanted extensions out of the Chrome Web Store. The latest change of that kind has been announced for August 27th 2020, when Google plans to boot from the CWS “low-quality and misleading” Chrome extensions.
Understanding forwarding, peering, and private zones in Cloud DNS (Google Cloud Blog, May 01 2020)
The Domain Name System, or DNS, is one of the most foundational services of the Internet, turning human-friendly domain names into IP addresses. Often handled by specialized network engineers within an organization, DNS can feel like a black box to people who don’t deal with it often. For one, DNS terminology can be confusing, and some terms have different meanings in different parts of the cloud network (e.g. peering). But understanding how DNS works is critical, especially in a cloud environment, where you need DNS to make your applications available to enterprise users.
Filter Out the Noise
Since I started this curated newsletter in June 2017, I’ve clipped ~14,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share today’s post on Twitter Facebook LinkedIn
COVID-19 Fails to Stop Aggressive Growth in Q1 Cloud Spending (eWEEK, Apr 30 2020)
…evidence pointing to COVID-19-related market tailwinds as additional enterprise workloads are pushed onto public clouds.
What’s happening with all things cloud: Existing and future cloud strategies (Help Net Security, Apr 30 2020)
Cloud spend exceeds budgets as organizations expect increased cloud use due to COVID-19, according to a Flexera report.
Tackling the SDLC With Machine Learning (SecurityWeek, May 05 2020)
Businesses’ digital transformations continue to show that being relative and competitive are directly tied to the ability to develop and harness software. As the CEO of Microsoft, Satya Nadella, oft says—“every company is now a software company.”
Keeping your app’s secrets secret (Help Net Security, Apr 30 2020)
The software development process has vastly changed in this past decade. Thanks to the relentless efforts of the cloud and virtualization technology providers, we now have nearly limitless compute and storage resources at our fingertips. One may think of this as the first wave of automation within the application development and deployment process. With the rise in automation, machines must authenticate against each other. Authorization is nearly implicit in this handshake.
Securing Internet Videoconferencing Apps: Zoom and Others (Schneier on Security, Apr 30 2020)
The NSA just published a survey of video conferencing apps. So did Mozilla. Zoom is on the good list, with some caveats. The company has done a lot of work addressing previous security concerns. It still has a bit to go on end-to-end encryption.
Protecting corporate data in popular cloud-based collaborative apps (Help Net Security, May 04 2020)
Cloud adoption has grown at an astonishing rate, providing organizations with the freedom to store data in numerous cloud applications that meet their specific business demands. Additionally, migrating to the cloud gives employees the ability to access work material from anywhere and anytime.
SaltStack bug helps hackers access LineageOS and Ghost infrastructure (CyberScoop, May 05 2020)
LineageOS, a free Android-based operating system, and Ghost, a nonprofit behind widely used blogging software, reported Sunday that unidentified hackers had breached their infrastructure in apparently separate incidents. The disruptions are an example of how bugs found in widely used code often end up being exploited maliciously — even when software updates are available.
Zoom Installers Used to Spread WebMonitor RAT (Dark Reading, May 04 2020)
Researchers warn the installers are legitimate but don’t come from official sources of the Zoom app, including the Apple App Store and Google Play.
Instacart Patches Security Bug That Would Have Let Attackers Spoof SMS Messages (Dark Reading, May 05 2020)
Attackers could have exploited the issue to lead online shoppers to malicious websites or to get them to download malware, Tenable says.
Microsoft Offering Up to $100,000 for Vulnerabilities in Azure Sphere (SecurityWeek, May 05 2020)
Microsoft on Tuesday announced a new security research challenge that encourages white hat hackers to find and responsibly disclose vulnerabilities in the company’s Azure Sphere solution.
Checkmarx Named a 2020 Gartner Magic Quadrant Leader for Application Security Testing (Checkmarx, May 05 2020)
According to the report, “Modern application design and the continued adoption of DevSecOps are expanding the scope of the AST market. Security and risk management leaders will need to meet tighter deadlines and test more complex applications by seamlessly integrating and automating AST in the software delivery life cycle.”