How Stratum thinks about Internet-exposed SSH Recently one of our customers engaged Stratum to perform a pentest of their external perimeter. We found a few instances of SSH exposed to the internet and write it up as a low severity finding. The SSH instances didn't show to be vulnerable (at the time of the
cloud security Beyond the Buzz: AI Security Unpacked Stratum Security's Jared Perry gave a webinar on the state of AI security, the AI landscape in the context of security, and how organizations are using AI/LLMs and what this means for risk.
pentest Message Post-Delivery Analysis Using Microsoft Sentinel To Improve Email Threat Detection and Response We helped a customer understand their inbound threat detection and response effectiveness and make a data-driven decision on how to improve it.
Cloud Providers Are Setting You Up For Failure Stratum's own Jared Perry gave a great talk at Code Europe in 2022. They posted the video today. Jared's perspective is based on performing hundreds of cloud security assessments for Stratum's customers. This is a great talk by someone who has a TON of
Amazon Web Services Core Assessment Playbook & Questionnaire Stratum performs an ever-increasing number of AWS security assessments for our customers from large to small. These deep-dive assessments help identify deficiencies within the customer's AWS configuration and processes that may expose the customer to risk. Example findings include specific configuration vulnerabilities such as overly permissive security groups,
cloud security What we learned about cloud security running a SaaS in AWS for 5 years - Part 5 - EC2 Instance Security This is Part 5 of a multi-part series of posts on how we securely ran ThreatSim in AWS for 5 years and never lost a customer (that we know of) due to any cloud security concerns. There are tons of resources for all kinds of host security. In this post,
SameSite - Defense in Depth for HTTP Cookies Not a lot has changed in recent years with the security of HTTP cookies. As web application security testers, we have been performing a pretty standard set of tests in this area, including a check for two well-known cookie flags, HttpOnly and Secure. Recently, at Stratum Security we started adding
What we learned about cloud security running a SaaS in AWS for 5 years - Part 4 - Network Security This is Part 4 of a multi-part series of posts on how we securely ran ThreatSim in AWS for 5 years and never lost a customer (that we know of) due to any cloud security concerns. In a traditional data center, network security plays a huge role in how you
What we learned about cloud security running a SaaS in AWS for 5 years - Part 3 - Identity and Access Management This is Part 3 of a multi-part series of posts on how we securely ran ThreatSim in AWS for 5 years and never lost a customer (that we know of) due to any cloud security concerns. When we set up shop in AWS we ran through different risk models to
What we learned about cloud security running a SaaS in AWS for 5 years - Part 2 - AWS Account Security This is Part 2 of a multi-part series of posts on how we securely ran ThreatSim in AWS for 5 years and never lost a customer (that we know of) due to any cloud security concerns. In a traditional data center there are controls to prevent someone from turning off
aws What we learned about cloud security running a SaaS in AWS for 5 years - Part 1 This is the first in a series of posts on how we ran a SaaS in AWS that stored highly sensitive enterprise user data and not only had a good story to tell but also did right by our customers. There are several frameworks for cloud security (e.g. NIST,
exfiltration Featured Webinar wrap up: “Safeguarding your network from Data Exfiltration attacks” Read a recent news article about a data breach and it will likely mention data exfiltration. It’s usually the last event of a string of seemingly preventable mishaps that result in a lot of people getting free credit reporting (or, as of late, uncomfortable conversations with your spouse). The
