Archive

NewsletterNewsletter
[tl;dr sec] #173 - What Software Will Be Post GPT-4, the Cybersecurity Landscape, Reducing Attack Surface in AWS

[tl;dr sec] #173 - What Software Will Be Post GPT-4, the Cybersecurity Landscape, Reducing Attack Surface in AWS

The AI-based architecture that’ll replace most existing software, overview of cybersecurity companies and acquisitions, how to lock down instance creds and regions/services in AWS.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #172 - Career Resources, Machine Learning, Jim Manico Webinar

[tl;dr sec] #172 - Career Resources, Machine Learning, Jim Manico Webinar

Certs and getting into security, reinforcement learning for security, join Jim and I's webinar on broken access control.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #171 - AppSec and CloudSec Resilience, Audit Logs Wall of Shame, Compromised Cloud to Kubernetes Takeover

[tl;dr sec] #171 - AppSec and CloudSec Resilience, Audit Logs Wall of Shame, Compromised Cloud to Kubernetes Takeover

Building an effective AppSec and CloudSec program, vendors that don't prioritize high quality audit logs, tactics to go from a compromised cloud resource to taking over a Kubernetes cluster.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #170 - Prototype Pollution, Fuzzing, SOC Metrics

[tl;dr sec] #170 - Prototype Pollution, Fuzzing, SOC Metrics

Black-box prototype pollution without the DoS, fuzzing curl and gaining coverage with LLMs, and useful metrics to build an effective SOC.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #169 - Top 10 Web Hacking Techniques of 2022, Finding Malicious Dependencies, Fearless CORS

[tl;dr sec] #169 - Top 10 Web Hacking Techniques of 2022, Finding Malicious Dependencies, Fearless CORS

Portswigger released a curated list of awesome web security research from last year, some approaches to finding malicious dependencies + open source tools, a great deep dive into CORS + principles on making a solid CORS middleware library

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #168 - GCP and Azure Storage Threat Models, macOS Security, Red Team Resources

[tl;dr sec] #168 - GCP and Azure Storage Threat Models, macOS Security, Red Team Resources

Detailed threat models for Google Cloud Storage and Azure Storage, Mac malware of 2022 and emerging payload obfuscation techniques, reverse engineering Rust binaries, offensive security and RE course, and more.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #167 - SBOM, Scaling Security Alert Management, Mitigating RBAC-Based PrivEsc in Kubernetes

[tl;dr sec] #167 - SBOM, Scaling Security Alert Management, Mitigating RBAC-Based PrivEsc in Kubernetes

Generating SBOMs and evaluating their quality, how Brex manages and automates security alerts at scale, how popular k8s platforms hardened themselves.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #166 - 2023 Security Predictions, Vuln Hunting with App Server Logs, Enforcing Device AuthN

[tl;dr sec] #166 - 2023 Security Predictions, Vuln Hunting with App Server Logs, Enforcing Device AuthN

Predictions for offense, from security leaders, and AWS, high signal vuln finding from application runtime exceptions, how Pinterest enforces managed and compliant devices in their Okta flow.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #165 - Hunting for Malicious Persistence in the Cloud, GitHub Action Security, Dark Sides of Machine Learning

[tl;dr sec] #165 - Hunting for Malicious Persistence in the Cloud, GitHub Action Security, Dark Sides of Machine Learning

How to detect malicious persistence in AWS, GCP, and Azure, leaking GitHub Action secrets and improving OIDC security posture, will ChatGPT degrade communication online?

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #164 - Becoming Phishless, Machine Learning, Memory Safe Languages in Android 13

[tl;dr sec] #164 - Becoming Phishless, Machine Learning, Memory Safe Languages in Android 13

How a number of companies adopted WebAuthN and/or hard keys, neat new things in ML, the impact of Rust and memory safety in general in Android 13.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #163 - Rebuilding Detection and IR at LinkedIn, CVEs and Misaligned Incentives, 2022 in Review and 2023 Predictions

[tl;dr sec] #163 - Rebuilding Detection and IR at LinkedIn, CVEs and Misaligned Incentives, 2022 in Review and 2023 Predictions

How LinkedIn scaled detection and minimized toil, why ReDoS CVEs are mostly noise, and reflecting on security in 2022 and predicting what 2023 has in store.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #161 - ChatGPT, Scaling Vulnerability Management in Microservices, Supply Chain

[tl;dr sec] #161 - ChatGPT, Scaling Vulnerability Management in Microservices, Supply Chain

Many varied examples of using ChatGPT, how Lyft precisely fixes OS and OS-package level vulnerabilities across ~1,000 services, Sigstore and dangerous subtleties in the GitHub download artifacts API.

Clint Gibler
Clint Gibler
FirstBack
678910111213
Next Last