🔨 Wielding Your Analytical Hammer

Let me share an anecdote, in case it resonates with you.

From when I was a young kid, my parents encouraged me and celebrated when I did well in school.

My self identity was very much tied to getting good grades, and being “smart” in subjects like math.

To be honest, and I feel bad saying this, I didn’t place a lot of value on emotional intelligence (EQ)… most of my life 😅 

But what’s very frustratingly smacked me in the face the past few years is that there are a number of domains where being analytical is fundamentally not the right tool (e.g. relationships, building closeness with friends). I stumbled across the following and I was like… yup:

If I could go back in time five or ten years and tell myself only one thing that would overall improve my happiness/life in general, it would be to invest more in developing EQ. (and buy NVIDIA)

Anywho, I share this in case it sounds familiar to you, so you can hopefully avoid some of my mistakes, dear reader.

Sponsor

📣 Accelerate your phishing remediation while reducing on-call burden

It’s a never-ending battle to secure mailboxes. Phishing reports from users fly in continuously and security teams race against the clock to respond and remediate.

Material Security acts as a force multiplier for user report response, applying instant protection across the entire workforce when a single case comes in. You get faster report resolution and less duplication efforts.

The security engineering manager at Compass shared:

“With Material’s API, we can take a big problem like phishing and break it into bite size chunks to do things in a more advanced way.”

👉 Cut your triage and response time 👈

Secure Guardrails

Sponsor

📣 Webinar - How to keep an Identity Attack from Compromising your Infrastructure

Identity Platforms (IdP) provide organizations with incredible convenience with Single Sign-On (SSO). However, if IdPs are compromised, the ‘keys to the castle’ can be left vulnerable, making the rest of the organization’s infrastructure vulnerable as well.

In this webinar, learn how Teleport and Yubico together help you implement passwordless authentication paired with an Infrastructure Defense-in-Depth (IDiD) approach to security while positively impacting productivity and preventing further compromise in your downstream systems in a case of an IdP breach.

👉 Register Today 👈

Passwordless authentication + infrastructure defense-in-depth?! Let’s go! 🤘 

AppSec

ManuelBerrueta/FlowAnalyzer
By Manuel Berrueta: A tool designed for in-depth understanding and testing of OAuth 2.0 flows, including OpenID Connect (OIDC).

Why Good Security Fails: The Asymmetry of InfoSec Investment
Google Cloud CISO Phil Venables examines the paradox where effective security measures reduce incidents, prompting organizations to cut resources, which then degrades security controls and increases risks. To avoid this cycle, Phil suggests strategies such as organization health monitoring, zero-based budgeting, delivering incremental benefits, building support, and making resource constraints visible to maintain security effectiveness.

💡 If you haven’t already read Phil’s blog, allow me to make your life better. Every post is insightful and useful 👌 

A Race to the Bottom
Doyensec’s Viktor Chuchurski explores how inadequate concurrency control in databases can lead to race condition vulnerabilities, causing issues like dirty reads, non-repeatable reads, phantom reads, and lost updates. The article details the four ANSI SQL-92 isolation levels—Read Uncommitted, Read Committed, Repeatable Read, and Serializable—and their effects on data consistency. This research was presented at 2024 Global AppSec Lisbon presentation (slides, video).

Viktor provides a vulnerable Go application for hands-on experimentation with database transactions and concurrency control, and Semgrep rules to detect instances of unspecified isolation levels.

Cloud Security

Scaling the IAM mountain: An in-depth guide to identity in Google Cloud
Google’s Sita Lakshmi and Michele Chubirka demystify two foundational IAM access control principles: least privilege and separation of duties. The authors introduce the persona mapping technique, which simplifies permission management and ensures consistent access control by mapping job functions to groups.

Moving AWS Accounts and OUs Within An Organization
Matthew Fuller explores the implications of moving an AWS account or Organizational Unit (OU) to another OU within the same Organization. He discusses impacts on SCP policy inheritance, CloudFormation StackSet deployments, IAM policy conditions, RAM shares, and Control Tower enrollments.

Journey to the Center of the VPC: Getting Started with Cloud Networks
Rich Mogull explains the basics of traditional packet-switched networks and introduces AWS Virtual Private Clouds (VPCs), which use software-defined networking (SDN) to secure and isolate customer traffic, preventing spoofing and sniffing. He also provides a hands-on lab to explore VPC code primitives.

Container Security

Blue Team

activecm/rita
RITA (Real Intelligence Threat Analytics) is an open-source framework for detecting command and control communications through network traffic analysis. It ingests Zeek logs and supports features such as beaconing detection, long connection detection, DNS tunneling detection, and threat intel feed checking. Sponsored by Active Countermeasures.

Inside the ransomware playbook: Analyzing attack chains and mapping common TTPs
James Nutland shares the results from an analysis of 14 ransomware groups between 2023 and 2024, identifying common TTPs like credential phishing, exploiting vulnerabilities in Netlogon and Fortinet's FortiOS SSL VPN, and leveraging legitimate tools like AnyDesk and ScreenConnect for command & control.

Building a Detection Engine
Nathan Burns explores the mechanics of detection engines, comparing heuristic-based and rule-based approaches. He highlights challenges such as false positives and maintenance for on-host engines, and latency and lack of prevention for off-host engines. Nathan also discusses the advantages of off-host engines, including reduced resource utilization, advanced correlation, and historical analysis, offering a balanced view of both methods

Red Team

HadessCS/Red-team-Interview-Questions
By Mohammadreza Rashidi: A comprehensive list of questions for red team interview preparation, covering topics such as initial access, Windows internals, Active Directory, PowerShell, malware development, and different attack techniques.

AI + Security

Misc

• Defguard - An open-source solution with real WireGuard MFA/2FA & integrated OpenID Connect SSO.

• Recently I saw Idina Menzel (Rent, Wicked, Elsa in Frozen) perform live, and her rendition of You Learn to Live Without was stunning. Consider it NSFW, if you don’t feel safe crying at work 😭 

• If you’re thinking about watching Deadpool and Wolverine this weekend, here’s a 30min recap of all of Marvel cinema history, and a one hour history of Deadpool.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint
@clintgibler