[tl;dr sec] #19 - Epic Post Next Week, Beyond Beyond Corp, Cloud Security Tools

[tl;dr sec] #19 - Epic Post Next Week, Beyond Beyond Corp, Cloud Security Tools

[tl;dr sec] #18 - \"GitHubification\" of Infosec, Ring Privacy, Ransomware Economics

Blue teams can become highly leveraged by sharing knowledge effectively, Ring's partnerships with the police, viewing ransomware through an economic lens.

[tl;dr sec] #17 - AWS Re:Invent, Supply Chain Security, Absolute AppSec

A number of interesting new AWS services, backdoors on PyPI, I had a blast on the Absolute AppSec podcast, and tl;dr sec hits 500 subscribers! 🚀

The Art of Vulnerability Management

[tl;dr sec] #16 - Art of Vulnerability Management, Cloud Security, Flan Scan, SCORE Bot

Building an effective vulnerability management process, K8s/AWS tips, network & code scanning tools, privacy preserving VA, and the Siege of Gondor.

Pose a Threat: How Perceptual Analysis Helps Bug Hunters

How to get faster, more complete external attack surface coverage by automatically clustering exposed web apps by visual similarity.

[tl;dr sec] #15 - OSINT + Screenshots, Fuzzing, and 2 Fast 2 Discoverious

Summary of an AppSec Cali 2019 talk on more efficient network penetration tests via clustering similar screenshots, fuzzing tools and articles, Bugcrowd/Bitdiscovery asset inventory partnership.

DevSecCon Tel Aviv 2019 Roundup

[tl;dr sec] #14 - DevSecCon TLV, Slack's Secure Overlay Network, Dangers of Struct Padding

DevSecCon Tel Aviv 2019 talk notes, Slack releases Nebula, AWS instance metadata hardening, OSINT tips, struct padding can leak heap memory, deadlock challenges, formal methods.

[tl;dr sec] #13 - Being Powerful While Powerless, Sadcloud, and Bugcrowd's Asset Inventory Service

Gusto's Nathan Yee on being impacful as an IC without a senior title in a start-up, intentionally vulnerable AWS infrastructure for training, and even more asset inventory offerings.

Being Powerful While Powerless: Elevating Security By Leading Without Authority

[tl;dr sec] #12 - Killing CSRF, MITRE ATT&CK Cloud, Cache Poisoned DoS

Browser default *SameSite* cookie settings will mostly kill CSRF, and a malicious header can block any web resource served by a CDN or proxy cache.