DevSecCon Tel Aviv 2019 Roundup

[tl;dr sec] #14 - DevSecCon TLV, Slack's Secure Overlay Network, Dangers of Struct Padding

DevSecCon Tel Aviv 2019 talk notes, Slack releases Nebula, AWS instance metadata hardening, OSINT tips, struct padding can leak heap memory, deadlock challenges, formal methods.

[tl;dr sec] #13 - Being Powerful While Powerless, Sadcloud, and Bugcrowd's Asset Inventory Service

Gusto's Nathan Yee on being impacful as an IC without a senior title in a start-up, intentionally vulnerable AWS infrastructure for training, and even more asset inventory offerings.

Being Powerful While Powerless: Elevating Security By Leading Without Authority

[tl;dr sec] #12 - Killing CSRF, MITRE ATT&CK Cloud, Cache Poisoned DoS

Browser default *SameSite* cookie settings will mostly kill CSRF, and a malicious header can block any web resource served by a CDN or proxy cache.

[tl;dr sec] #11 - ShellCon 2019 Roundup

Some ShellCon talk summaries, Dropbox and Twilio on detection and response automation, updates from the Chrome security team.

[tl;dr sec] #10 - Cloudflare on Security, IAM Least Privilege, & Finding XSS in Firefox's UI

Cloudflare's CTO on how they think about security, Salesforce's tool to make IAM least privilege policy generation easier, and finding XSS in Firefox's UI using AST matching.

[tl;dr sec] #9 - Autonomous Bug Reporting, HTTP Desync Attacks, & Censorship

Fuzzing is finding security bugs faster than CVEs can be issued, HTTP desync attacks advance, China's censorship power is felt around the world.

[tl;dr sec] #8 - DevSecCon Seattle 2019

DevSecCon Seattle 2019 Round Up

[tl;dr sec] #7 - AppSec Cali 2019 DevSecOps Panel Summary

Notes from an AppSec Cali 2019 panel, AWS security tools, fuzzing with grammars and Gitlab, and Google P0's iOS exploit chain discovery.

Lessons Learned from the DevSecOps Trenches

[tl;dr sec] #6 - Post Hacker Summer Camp

Neat talks from Hacker Summer Camp on email -> phone number, DNS rebinding, automated C++ reverse engineering, and publicly exposed AWS EBS volumes.