Cloud Providers Are Setting You Up For Failure Stratum's own Jared Perry gave a great talk at Code Europe in 2022. They posted the video today. Jared's perspective is based on performing hundreds of cloud security assessments for Stratum's customers. This is a great talk by someone who has a TON of experience poking around in a TON
Amazon Web Services Core Assessment Playbook & Questionnaire Stratum performs an ever-increasing number of AWS security assessments for our customers from large to small. These deep-dive assessments help identify deficiencies within the customer's AWS configuration and processes that may expose the customer to risk. Example findings include specific configuration vulnerabilities such as overly permissive security groups, IAM privilege
cloud security What we learned about cloud security running a SaaS in AWS for 5 years - Part 5 - EC2 Instance Security This is Part 5 of a multi-part series of posts on how we securely ran ThreatSim in AWS for 5 years and never lost a customer (that we know of) due to any cloud security concerns. There are tons of resources for all kinds of host security. In this post,
SameSite - Defense in Depth for HTTP Cookies Not a lot has changed in recent years with the security of HTTP cookies. As web application security testers, we have been performing a pretty standard set of tests in this area, including a check for two well-known cookie flags, HttpOnly and Secure. Recently, at Stratum Security we started adding
What we learned about cloud security running a SaaS in AWS for 5 years - Part 4 - Network Security This is Part 4 of a multi-part series of posts on how we securely ran ThreatSim in AWS for 5 years and never lost a customer (that we know of) due to any cloud security concerns. In a traditional data center, network security plays a huge role in how you
What we learned about cloud security running a SaaS in AWS for 5 years - Part 3 - Identity and Access Management This is Part 3 of a multi-part series of posts on how we securely ran ThreatSim in AWS for 5 years and never lost a customer (that we know of) due to any cloud security concerns. When we set up shop in AWS we ran through different risk models to
What we learned about cloud security running a SaaS in AWS for 5 years - Part 2 - AWS Account Security This is Part 2 of a multi-part series of posts on how we securely ran ThreatSim in AWS for 5 years and never lost a customer (that we know of) due to any cloud security concerns. In a traditional data center there are controls to prevent someone from turning off
aws What we learned about cloud security running a SaaS in AWS for 5 years - Part 1 This is the first in a series of posts on how we ran a SaaS in AWS that stored highly sensitive enterprise user data and not only had a good story to tell but also did right by our customers. There are several frameworks for cloud security (e.g. NIST,
exfiltration Featured Webinar wrap up: “Safeguarding your network from Data Exfiltration attacks” Read a recent news article about a data breach and it will likely mention data exfiltration. It’s usually the last event of a string of seemingly preventable mishaps that result in a lot of people getting free credit reporting (or, as of late, uncomfortable conversations with your spouse). The
