[tl;dr sec] #16 - Art of Vulnerability Management, Cloud Security, Flan Scan, SCORE Bot

Building an effective vulnerability management process, K8s/AWS tips, network & code scanning tools, privacy preserving VA, and the Siege of Gondor.

Pose a Threat: How Perceptual Analysis Helps Bug Hunters

How to get faster, more complete external attack surface coverage by automatically clustering exposed web apps by visual similarity.

[tl;dr sec] #15 - OSINT + Screenshots, Fuzzing, and 2 Fast 2 Discoverious

Summary of an AppSec Cali 2019 talk on more efficient network penetration tests via clustering similar screenshots, fuzzing tools and articles, Bugcrowd/Bitdiscovery asset inventory partnership.

DevSecCon Tel Aviv 2019 Roundup

[tl;dr sec] #14 - DevSecCon TLV, Slack's Secure Overlay Network, Dangers of Struct Padding

DevSecCon Tel Aviv 2019 talk notes, Slack releases Nebula, AWS instance metadata hardening, OSINT tips, struct padding can leak heap memory, deadlock challenges, formal methods.

[tl;dr sec] #13 - Being Powerful While Powerless, Sadcloud, and Bugcrowd's Asset Inventory Service

Gusto's Nathan Yee on being impacful as an IC without a senior title in a start-up, intentionally vulnerable AWS infrastructure for training, and even more asset inventory offerings.

Being Powerful While Powerless: Elevating Security By Leading Without Authority

[tl;dr sec] #12 - Killing CSRF, MITRE ATT&CK Cloud, Cache Poisoned DoS

Browser default *SameSite* cookie settings will mostly kill CSRF, and a malicious header can block any web resource served by a CDN or proxy cache.

[tl;dr sec] #11 - ShellCon 2019 Roundup

Some ShellCon talk summaries, Dropbox and Twilio on detection and response automation, updates from the Chrome security team.

[tl;dr sec] #10 - Cloudflare on Security, IAM Least Privilege, & Finding XSS in Firefox's UI

Cloudflare's CTO on how they think about security, Salesforce's tool to make IAM least privilege policy generation easier, and finding XSS in Firefox's UI using AST matching.

[tl;dr sec] #9 - Autonomous Bug Reporting, HTTP Desync Attacks, & Censorship

Fuzzing is finding security bugs faster than CVEs can be issued, HTTP desync attacks advance, China's censorship power is felt around the world.

[tl;dr sec] #8 - DevSecCon Seattle 2019

DevSecCon Seattle 2019 Round Up