Archive

NewsletterNewsletter
[tl;dr sec] #158 - Open Security Jobs, Career Advice, Internet Egress Filtering at Lyft

[tl;dr sec] #158 - Open Security Jobs, Career Advice, Internet Egress Filtering at Lyft

Open jobs from over 35 companies, great career advice from a variety of people, how Lyft achieved egress filtering on all services.

Clint Gibler
Clint Gibler
BlogBlog
Container Security

Container Security

A collection of container security resources and tools, organized by category.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #157 - Transforming Security Champions, Production-ready osquery, Compromising Self-hosted GitHub Runners

[tl;dr sec] #157 - Transforming Security Champions, Production-ready osquery, Compromising Self-hosted GitHub Runners

Tanya Janca on building a security champions program, highly turned osquery detections, gaining GitHub Runner persistence and how to detect compromises.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #156 - Hipster History of CORS, Serverless Security Event Data Pipelines, Evaluating Container Attack Detection

[tl;dr sec] #156 - Hipster History of CORS, Serverless Security Event Data Pipelines, Evaluating Container Attack Detection

Dev's hilarious and useful history of the Internet and browser security, new toolkit from Brex to easily normalize and enrich security event data, additional Kubernetes attack methods and evaluating Falco.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #155 - Understanding IAM, Autogenerate Art from Blog Post, Attacking Closed DNS Resolvers

[tl;dr sec] #155 - Understanding IAM, Autogenerate Art from Blog Post, Attacking Closed DNS Resolvers

Understanding AWS permission boundaries and IAM policy evaluation, use ML to create art for your blog post based on its text, taking over your infrastructure Kaminsky style.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #154 - The State of AWS Security, Career Resources, Authorization

[tl;dr sec] #154 - The State of AWS Security, Career Resources, Authorization

Insights from the security posture of 600+ orgs, security career pathways mindmap and security communities overview, a number of resources about authorization.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #153 - Postgres' Insecure Defaults, SBOM, Prototype Pollution

[tl;dr sec] #153 - Postgres' Insecure Defaults, SBOM, Prototype Pollution

How PostgreSQL server and client TLS defaults will make you sad, SBOM tools and reflections, walkthroughs to learn how prototype pollution works.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #152 - Infra as Code Security, Linux Distro for Supply Chain Security, CI/CD Security

[tl;dr sec] #152 - Infra as Code Security, Linux Distro for Supply Chain Security, CI/CD Security

Detailed IaC security guide with ~90 references, new Linux with default security measures for the software supply chain, securing and attacking SCM and CI systems.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #151 - Why Security Products Fail, Pentesting.Cloud, CVE North Stars

[tl;dr sec] #151 - Why Security Products Fail, Pentesting.Cloud, CVE North Stars

Why security products can be ineffective, cloud pen testing exercises, review CVEs to learn vulnerability discovery.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #150 - How to Start an AppSec Program with the OWASP Top 10, Leadership in Cybersecurity, Magic GitHub API Proxy

[tl;dr sec] #150 - How to Start an AppSec Program with the OWASP Top 10, Leadership in Cybersecurity, Magic GitHub API Proxy

Building an effective and scalable AppSec program by leaning into secure defaults, leadership tips, proxy that enables least privilege use of GitHub API tokens.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #149 - Incident Response in AWS, CISA's Supply Chain Security Guidance, Recon

[tl;dr sec] #149 - Incident Response in AWS, CISA's Supply Chain Security Guidance, Recon

How to prep for and handle an incident in AWS well, detailed PDF guide by NSA and CISA on software supply chain security, various OSINT and recon tools.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #148 - OWASP Kubernetes Top 10, GraphQL Batching Attacks, Abusing Debugging in Electron Apps

[tl;dr sec] #148 - OWASP Kubernetes Top 10, GraphQL Batching Attacks, Abusing Debugging in Electron Apps

Top 10 Kubernetes ecosystem risks to consider, more effective GraphQL brute forcing woth Turbo Intruder, running arbitrary JavaScript in Electron apps.

Clint Gibler
Clint Gibler
FirstBack
910111213141516
Next Last