cloud security

Cloud Security Fitness Guide – Exercise #10: Watch World-Readable and Listable S3 Bucket Policies

S3 has been around for quite some time. It may be the oldest Service in the ever expanding Web Services provided by...

Cloud Security Fitness Guide – Exercise #9: Do Not Allow 0.0.0.0/0 Unless You Mean It

In the last post, John Martinez wrote about how Autoscaling can help an application deployed on AWS survive an attack....

Cloud Security Fitness Guide – Exercise #8: Use AutoScaling to Dampen DDoS Effects

 We’re switching the series up a little bit and going to pay some attention to the network layer for a couple of...

Cloud Security Fitness Guide – Exercise #6: Rotate all the Keys Regularly

In the previous article, we had a pretty deep discussion on how and why to limit privilege in the AWS IAM service....

Cloud Security Fitness Guide – Exercise #7: Use IAM Roles with STS AssumeRole

We are more than half way through the top ten, so let's finish up the IAM discussion before jumping into some of the top...

Cloud Security Fitness Guide – Exercise #4: Use Roles for EC2

By now, you're getting the theme that security on AWS is all about being proactive. The point of proactive security is...

Cloud Security Fitness Guide – Exercise #3: Reduce IAM Users with Admin Rights

Based on the last two posts, you have disabled your AWS root user; removed any root keys, assigned an MFA to that user,...

Cloud Security Fitness Guide – Exercise #2: Enable MFA Tokens Everywhere

Here we are, a week later and now following up on to the second installment of our recommended Top Ten Security Best...

Cloud Security Fitness Guide – Exercise #1: Disable Root Account API Access Key

Today, we kick off a series on the top 10 security best practices we've come across based on our own experiences. As AWS...

Cloud Security Fitness Guide – Exercise #11: CloudTrail and Encryption

Moving your architecture to AWS in whole or part also means that your team reaps the rewards of new changes and services...

Cloud Security Fitness Guide – Exercise #5: Least Privilege

In the previous post in this series, I discussed a great way for EC2 instances to be able to use AWS services securely,...

UN Report: Half of Nations Lack National Cybersecurity Plan

An analysis of the national cybersecurity preparedness of the world’s countries reveals news both good and bad. The...