Sign up to save your podcasts
Or
Share Cloud Security News
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Cloud Security News episodes
- 20 October, 2021 - Google Cloud Next 21 - All the Security Updates
Cloud Security News this week 20 October 2021
- Google Cloud is adding new features to their zero trust access solution, BeyondCorp Enterprise which will enable identity and context-aware access to non-web applications running in Google Cloud and non-Google Cloud environments. They also claim to be making it easier for admins to diagnose access failure, triage events, and unblock users with the new Policy Troubleshooter feature.
- If you are familiar with XDR - which allows for Extended Detection and Response (XDR) across endpoints, networks, cloud and workspaces. Google also announced a new collaboration with Cybereason to deliver a cloud-native XDR solution . The intent is to automate prevention for common attacks, guide analysts through security operations and incident response, and enables arguably faster threat hunting.
- They are also enhancing the integration between Chronicle (a SaaS SIEM built on core Google infrastructure that provides security analytics at the speed) and Security Command Center (SCC) on GCP to allow for centralized alerts and investigative workflows across the two platforms, and enables threat-specific pivots by enriching SCC alerts with intelligence on associated threat actors and entities.
- Google is also strengthening their protection of sensitive data through Automatic DLP (data loss prevention) which is in preview and ensuring encryption of data in transit using Ubiquitous Data Encryption, External Key Management, and Cloud Storage products.
- Google launched a new Build Integrity feature for Cloud Build which allows to automatically generates a verifiable build manifest that includes a signed certificate describing the sources that went into the build, the hashes of artifacts used, and other parameters.
- For Google Workspaces they have also introduced new security features.
Episode Show Notes on Cloud Security Podcast Website.
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
Instagram - Cloud Security News
If you want to watch videos of this LIVE STREAMED episode and past episodes, check out:
- Cloud Security Podcast:
- Cloud Security Academy:
6 min - 14 October, 2021 - Google Cloud Next 21, Kubecon + VMworld
Cloud Security News this week 14 October 2021
It's an eventful month for all things cloud as Google Cloud Next 21 and Kubecon are happening this week. Ashish from Cloud Security Podcast was co-hosting the Capture the Flag today with Magno Logan from Trend Micro, you can check it out here.
In next week’s episode we will be bringing to you the best bits from Kubecon and Google Cloud Next 21.
You can view these events virtually at the links below
Google Cloud Next 21
Kubecon
- Google Cloud announced the launch of Google Cybersecurity Action Team, a group of experts from across Google that will form what they believe is the world’s premier security advisory team. The role of this team would be to shape security transformation — from roadmap and implementation, through to responding to a major incident, to engineering new solutions.
- VMware also hosted their annual conference VMworld last week with a big focus on multicloud. They announced their strategy to help customers navigate the multi-cloud era with the launch of VMware Cross-Cloud services. VMware shared that the Cross-Cloud services will deliver three key advantages: an accelerated journey to the cloud, cost efficiency, flexibility and control across any cloud. You can find out more about this here and view VMworld on demand here
- Amazon owned gaming service Twitch has suffered a huge data leak late last week, with more than 100 gigabytes of data, reportedly taken from 6000 internal Twitch GitHub repositories.The leak has exposed list of Twitch creator payments showing several top earners on the site earned close to $10 million. Some gamers caught up in the leak have verified that the payouts are accurate.
- Wiz has become the fourth-most-valuable venture-backed cybersecurity company in the world, raising $250 million on a $6 billion valuation
- Huawei Cloud has become 2nd largest in China and 5th largest in the world according to Gartner
Episode Show Notes on Cloud Security Podcast Website.
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
Instagram - Cloud Security News
If you want to watch videos of this LIVE STREAMED episode and past episodes, check out:
- Cloud Security Podcast:
- Cloud Security Academy:
5 min - 06 October, 2021 - AWS Launches Cloud Control API
Cloud Security News this week 06 October 2021
- AWS has announced the availability of AWS Cloud Control API - a set of common application programming interfaces (APIs) that are designed to make it easy for developers to manage their AWS and third-party services. AWS Cloud Control API can be used to create, read, update, delete, and list (CRUD-L) your cloud resources that belong to a wide range of services—both AWS and third-party. You won't have to generate code or scripts specific to each individual service responsible for those resources.We have linked in the podcast notes a informative video from AWS that explains more about this
- The inaugural HashiCorp State of Cloud Strategy Survey with about 3200 responses has shared that multi-cloud is no longer aspirational goal but an everyday reality - with ¾ of the respondents noting that they were using 2 clouds or more, top drivers for multicloud adoption are digital transformation, avoid vendor lock in, cost reduction and scaling, many enterprises are yet to realise substantial value from their cloud investment and Cloud skills shortage still remains a major challenge
- Amazon, Google, Microsoft, Atlassian, CISCO, IBM, Salesforce, Slack and SAP have joined forces to establish the Trusted Cloud Principles as a commitment to protect the rights of their customers. AWS tweeted that this is to “help safeguard the interests of organizations and the basic rights of individuals using cloud services” You can view the Trusted Cloud Principles here.
- Orca Security has secured $550 million in Series C funding to raise their valuation to $1.8 Billion, investment was led by Temasek, an investment company he adquartered in Singapore. Orca Security has a patent-pending SideScanning™ technology that collects data directly from cloud provider APIs/ cloud configuration and the workload’s runtime block storage out-of-band to detect vulnerabilities, malware, misconfigurations, lateral movement risk, weak and leaked passwords, and unsecured personal identifiable information.
Episode Show Notes on Cloud Security Podcast Website.
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
Instagram - Cloud Security News
If you want to watch videos of this LIVE STREAMED episode and past episodes, check out:
- Cloud Security Podcast:
- Cloud Security Academy:
4 min - 29 Sep, 2021 - Foggyweb Malware, New Cloud Data Framework + OWASP Top 10
Cloud Security News this week - 29 September 2021
- Amazon Web Services, Google Cloud, IBM, and Microsoft have joined forces this week with the Enterprise Data Management (EDM) Council to publish a framework for managing data in the cloud. The new cloud data management capabilities (CDMC) framework was developed over the last 18 months with participation from more than 100 leading companies. The framework can be found here
- Microsoft has published information this week on a new malware it calls FoggyWeb which has been deployed by Russia-linked threat actors Nobelium who are said to be behind the devastating SolarWinds supply chain attack. Microsoft’s published document can be found here
- For those of you familiar with OWASP (Open Web Application Security Project), OWASP celebrated its 20th anniversary last week with a 24-hour webinar + launched their top 10 web security vulnerabilities for 2021 updated from 2017. It worth noting that there are a few updates relevant to cloud security - broken access control has moved from #5 to #1, insecure design and server side request forgery have now been added while security misconfiguration has made it to top 5. You can read more about it here
- Trufflehog, a git repository scanner from Truffle Security was originally released in 2017. Recently an open source extension for chrome was released for Trufflehog that will help identify API Keys for SaaS and cloud providers that are often making their way into Javascript.
- Cloud Security Alliance released their The State of Cloud Security Risk, Compliance, and Misconfigurations report this month. Based on over 1000 responses from IT and security professionals.
Episode Show Notes on Cloud Security Podcast Website.
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes, check out:
- Cloud Security Podcast:
- Cloud Security Academy:
4 min - 22 Sep, 2021 - Vulnerabilities in GCP, AWS and Amazon
Cloud Security News this week - 22 September 2021
- AWS, Google Cloud and Azure have all been busy last few weeks fixing and patching Vulnerabilities. In addition to Azure's OMIGOD flaws which we covered in last week’s episode, Google Cloud reported that some of their load balancers were routing to an Identity-Aware Proxy (IAP) enabled Backend Service which could have been vulnerable to an untrusted party. Google Cloud have confirmed that this issue has been resolved.
- Rhino Security Labs have discovered a vulnerability in AWS WorkSpaces, amazon’s virtual desktop. Exploiting this vulnerability allows commands to be executed if a victim opens a malicious WorkSpaces URI from their browser. Rhino reported the vulnerability to Amazon and it was promptly patched.
- Attackers have begun to exploit critical Microsoft Azure vulnerabilities that were reported in last week’s episode. The OMIGOD flaws, discovered by the Wiz Research Team have since been patched by microsoft. New data indicates that attackers are scanning the Web for Azure Linux virtual machines that are vulnerable. If successful, an attacker could become root on a remote machine.
- For organisations and enterprises cloud is about improved flexibility, scalability, and cost-effectiveness. For cybercriminals, Cloud is an environment filled with poorly secured enterprise data, applications, and online assets. IBM in their recently released Security X-Force Cloud Threat Landscape Report highlight increased attacker interest in the thriving black market for stolen credentials used to access enterprise accounts and resources on public cloud platforms. IBM X-Force discovered about 30,000 cloud credentials potentially available for sale on Dark Web and Prices for these credentials ranged from a few dollars to more than $15,000 per credential, based on the level of access and the amount of credit associated with an account. Report available here
Episode Show Notes on Cloud Security Podcast Website.
Podcast Twitter - Cloud Security Podcast (@CloudSecPod)
If you want to watch videos of this LIVE STREAMED episode and past episodes, check out:
- Cloud Security Podcast:
- Cloud Security Academy:
3 min - 15 Sep, 2021 - Oracle superior to AWS? AWS Vulnerabilities Discovered and fwd:cloudsec conference held this week
Cloud Security News this week - 15 September 2021
- Oracle Chief Technology Officer and co-founder Larry Ellison told their investors this week that Oracle Cloud is superior to AWS when it comes to security and cost. He shared that they don't think an application should talk to five or six separate databases referencing AWS’ database offerings and calling it a very, very risky security architecture. If you are keen to learn more about how the cloud providers rank, Gartner released a report in July 2021 noting that over 90% of the worldwide cloud market was concentrated in just four cloud providers. Amazon Web Services and Microsoft lead the market with Alibaba and Google as the next closest competitors.
- The research team at Wiz has recently discovered four vulnerabilities in the little-known software agent called Open Management Infrastructure (OMI) that is embedded in many popular Azure services.When customers sets up a Linux virtual machine in their cloud, the OMI agent is deployed automatically when they enable certain Azure services. Without a patch, attackers can easily exploit these four vulnerabilities to escalate root or highest privileges and remotely execute malicious code. Microsoft has issued a patch to address this during their Patch Tuesday release on 14 September 2021
- Last year at the Reinvent Conference Amazon unveiled Amazon Elastic Kubernetes Service (Amazon EKS) Anywhere. Last week they announced the general availability of Amazon EKS Anywhere. It's a deployment option for Amazon EKS that enables you to easily create and operate Kubernetes clusters on premises using VMware sphere. Fully supported by AWS, Amazon EKS will enable users to automate cluster management, reduce support costs and provide the ability to view all their Kubernetes clusters, running anywhere.
- Tenable, best known for their IT vulnerability management, has agreed to acquire cloud-native security startup Accurics Inc. for $160 million. Accurics, founded in 2019, states that their platform self-heals cloud native infrastructure by codifying security throughout the development lifecycle. Traditionally, Tenable vulnerability management covers physical and virtual infrastructure , they made a few acquisitions in the last 2 years to extend their coverage to cloud and container in an attempt to to provide full coverage across risk identification and mitigation.
- fwd:cloudsec hosted their cloud security conference this week in-person and streamed live. fwd:cloudsec is a non-profit, conference on cloud security. You can view the entire conference on you tube or on their website ww.fwdcloudsec.org for discussions about all the major cloud platforms, both attack and defense research, limitations of security features, the pros and cons of different security strategies. This one is definitely a must attend for all things cloud security
4 min - 8 Sep, 2021 - IBM Launches Servers for Hybrid Cloud, Microsoft and Verizon bring 5G Edge Cloud Computing
Cloud Security News this week - 8 September 2021
- Verizon, a multinational telecommunications giant and Microsoft have teamed up to bring on-prem, private 5G edge cloud computing to business. Their offer is a cloud platform that puts compute and storage services at the edge of the network at the customer premises. This has the potential to offer lower lag time and high bandwidth for demanding applications such as virtual and augmented reality and machine learning.
- In Australia, as part of Macquarie bank path to be 100% cloud for IT infrastructure by 2022, they are embedding a 'secure by design' ethos. Secure by design is an approach to software engineering that is about creating code that is foundationally secure. Read more about Macquarie Bank Cloud Strategy here + here
- The FBI sent out a notice warning companies in the food and agriculture sector to watch out for ransomware attacks aiming to disrupt supply chains.. Cyber criminal threat actors exploit network vulnerabilities to exfiltrate data and encrypt systems in a sector that is increasingly reliant on smart technologies, industrial control systems, and internet-based automation systems. Acces the full document on our website www.cloudsecuritypodcast.tv - FBI Document here
- Lenovo has launched Global Everything-as-a-Service Strategy, bringing all of its as-a-Service offerings under one umbrella that makes everything from the pocket to the cloud available via a single contract framework.
Read more about it here- IBM has launched new generation of IBM Power servers for frictionless, scalable hybrid cloud. The new IBM Power10 processors are designed specifically for hybrid cloud environments. In a statement IBM has stated that the servers come with security enhancements and Red Hat hybrid cloud capabilities. The servers are meant to respond faster to business demands, protect data from core to cloud, streamline insights and automation and maximize availability and reliability.
3 min - 1 Sep, 2021 - Microsoft warns thousands of cloud customers of exposed databases
Cloud Security News this week - 1 Sep, 2021
- Last Thursday, on the 26th of August 2021 - Microsoft warned thousands of its cloud computing customers, including some of the world's largest companies. that hackers could have the ability to read, change or even delete their main databases. This is due to a vulnerability in the Jupyter Notebook Feature in Microsoft Azure's flagship Cosmos database. Microsoft cannot change those keys by itself, it emailed the customers Thursday telling them to create new ones.
- AWS has announced the release of AWS Backup Audit Manager a new feature that allows you to audit and report on the compliance of your data protection policies. AWS claims that it provides built-in compliance controls and allows you to customize those controls to define your data protection policies.
- Google Cloud has recently released on demand vulnerability scanning. Google claims that this will allow checking for vulnerabilities earlier in development. This new feature checks for vulnerabilities both in locally stored container images and images stored within GCP registries.
- A $2000 bug bounty has been claimed by researcher Robert Heaton, who was able to find a vulnerability in Bumble, a dating app which has more than 100 million users worldwide.
- By learning how Bumble's application programming interface (API) works the researchers found a way to pinpoint users' exact location, bypassing the safeguards in the app designed to prevent this.
- Lacework, a data driven security platform has released their quarterly cloud threat report. The report stated that Last year alone, cybercrime and ransomware attacks cost companies $4 billion in damages. They identified a rising demand for access to cloud accounts along with continued increases in scanning and probing of storage buckets, databases, orchestration systems, and interactive logins.
Follow us on @CloudSecPod
You may also like Cloud Security Podcast
3 min - 25 Aug, 2021 - AWS Re:inforce CANCELLED, AWS Launches Partner Program. Microsoft Protests NSA Contract
Cloud Security News this week - 25 Aug, 2021
- AWS is launching a new partner competency for managed security service providers (MSSPs) which will make their cloud software solutions and services available in the AWS Marketplace. AWS are coining this an industry first + designed to help partners differentiate themselves in a crowded security market
- Default Permissions on Microsoft Power Apps, a cloud-hosted suite of services that allows organizations to create business intelligence applications has exposed 38 million records. This was discovered by an upguard analyst that Open data protocol API is enabled by default
- AWS Cancelled re:Inforce Security Conference In Houston Due To COVID-19 and held, A scaled-down, free version of the event was held virtually on Aug. 24
- Microsoft has protested a $10B NSA Cloud Contract Awarded To AWS.
- A google cloud news a bit closer to home, Google's newest cloud region, in Melbourne, Australia, which launched just a month ago on 25 July. went down for 1 hour and 30 minutes due to 'transient voltage' issues that rebooted network hardware.
Follow us on @CloudSecPod
You may also like Cloud Security Podcast
2 min - Cloud Security News Trailer
Welcome to Cloud Security News, your weekly digest of what you need to know in the world of Cloud Security.
We do the hard work for you, so you are always across the important bits.
Brought to you by the team behind the much loved Cloud Security Podcast
Links
Cloud Security Podcast
1 min
About Cloud Security News
From the publisher's feed
Your weekly digest of what you need to know in the world of Cloud Security. We do the hard work for you, so you are always across the important bits.
Brought to you by the team behind the much loved Cloud Security Podcast