M. Dustin Brimberry

5 AWS re:inforce 2024 Highlights from Philly in less than 1 min 🎥 if you prefer reading 👇🏾 - this was the largest reinforce yet (if you hear the word on the street) - Lots of Cloud Security Practioners and Leaders in the audience - attendance from far wide - shout out to the folks from Peru 🇵🇪 , Nigeria 🇳🇬 , Japan 🇯🇵 & South Korea 🇰🇷 who reached out and met me. ❤️🙏🏾 - 3 Announcements from keynote - Malware Detection for S3, IAM Access Analyzer gets preview of possible IAM policy, Security Lake enrichment - Lots of Chalk talks on IAM were again popular this year too as identities are lot more complex than 2023 in 2024 We did interviews with practitioners and Leaders on top of mind topics like AI security, identity , Appsec, zero trust which will be coming on Cloud Security Podcast soon, if you are subscribed or follow the page - you would get notified when it is released. Did I miss any update from AWs reinforce 2024? Philly Must See Places included in Video - independence hall, Liberty Bell, Angelos Pizzeria, Rocky Steps - hope I covered all major Philly spot 😬 Cc Amazon Web Services (AWS) #aws #awsreinforce #cloudsecurity

68

8 Comments

Ponder .. A response to prompt:: “Yes, America's big three cloud providers—Amazon Web Services (AWS), Microsoft Azure, and Google Cloud—do operate in China, but under specific conditions. 1. **Amazon Web Services (AWS)**: AWS has partnered with a local Chinese company to provide its services in China. This partnership is necessary due to the regulatory environment and legal requirements. 2. **Microsoft Azure**: Microsoft also collaborates with a local partner to offer Azure services in China. This is part of their strategy to comply with Chinese regulations. 3. **Google Cloud**: Google Cloud does not have a direct presence in China, primarily due to the company’s stance on censorship and privacy. However, they may offer limited services through partnerships or indirect access. Overall, while these providers have made strides to establish a presence in China, they often do so through local partnerships to navigate the country's regulatory landscape effectively.” #China #GCP #AWS #Azure #Gemini #Cloud #Gemma

1

In my latest blog post, Brent Eager (from StormForge) and I talk about how they use Amazon Managed Service for Prometheus to manage their Optimize Live solution. https://lnkd.in/gFXUzX9n

14

Security Boulevard's coverage of Cribl's new research report highlights a 32% increase in the number of data sources, with Splunk, REST APIs, Windows event logs, and Amazon S3 at the top of the list. The report provides a wealth of information about current data trends, but one thing is clear: the amount of data being processed and analyzed by cybersecurity teams is increasing relentlessly. Read the full article 👇 https://gag.gl/Q98UrQ

1

Checkout the new blog post from the Rackspace Technology Cloud Developer Blog: https://lnkd.in/gQQe3iXy TL;DR I spent the weekend writing a new application, because sleep is for the weak. Meet Gisty: the code bin you didn't know you needed but might actually enjoy. Gisty was deployed on #Rackspace #OpenStack Flex: building an application and watching it deploy / scale effortlessly on the platform we're bringing to market has been incredibly satisfying. Highlights: * Writing a #Swift application to store data in Swift? Yep, I went there. It's meta, a pun, and a performance boost rolled into one * Containerized everything with Fedora CoreOS running Podman, in UBI-9 containers * OpenStack Application credentials made granting Gisty what is needed and securing access to my account a breeze * The UI is simple and features some fun toothpaste tubes: smiling when things work and looking hilariously disheveled when they don't; a quirky reminder that even when things get messy, there's always a way to clean them up * Simplified application stack, leveraging the OpenStack APIs to effortlessly scale. Rackspace OpenStack Flex is making open infrastructure native applications feasible and genuinely fun. If you're curious about how Gisty was built checkout the about page at "https://gisty.link/about." 🥂 Here's to embracing the open cloud, laughing along the way, and building things that make life a little more intriguing.

26

Roses are red, Proofs are blue, Automated reasoning, Is a party for two! 🎉 🤖 I've been trying hard to keep up with the latest developments in the world of provable security at Amazon Web Services (AWS) - https://lnkd.in/gZTpZ3yz - and let me tell you, it's a fascinating field 🤯 From model checking to SMT solvers, the tools of the automated reasoning trade are really bolstering cybersecurity efforts. Think about it - being able to mathematically verify the security properties of your systems? That's like having a crystal ball that tells you the future, except the future is way more secure. And the best part? You don't even need a PhD in theoretical computer science to get in on the action. You can see some of the awesome ways automated reasoning is being put to work for AWS customers in services like IAM Access Analyzer, Amazon S3 Block Public Access, Amazon VPC Network Analyzer, Amazon VPC Reachability Analyzer, and Amazon Verified Permissions. These tools can help you identify security risks, validate access permissions, and generally improve the security posture of your cloud infrastructure. So if you're looking to level up your security game, why not give automated reasoning a try? It's like having your own personal security expert, except WAY nerdier. Who's with me? Let's get our proof on! 🤓 #CloudSecurity #AwsCloud #AutomatedReasoning #ProveableSecurity #AwsSecurity #CyberSecurity #SecurityPosture

13

The single best piece of advice that I have heard when designing security for Cloud Native Applications: "Assume breach" #CNAPP #zerotrust #cloudnative #Kubernetes #containersecurity #cloudsecurity #eBPF #Istio #OpenShift #Rancher #AWS #Azure #GCP #Fortinet #PaloAltoNetworks #Zscaler #CrowdStrike #SentinelOne #EKS #AKS #GKE #Anthos #RedHat #Devops #SRE #Containers #GenerativeAI  

30

In late 2023 we reported that MySQL and MariaDB’s REPEATABLE READ did not, in fact, provide repeatable reads. The MariaDB team has been hard at work this past year. They’ve added a new flag, --innodb-snapshot-isolation=true, which causes REPEATABLE READ to prevent Lost Update, Non-repeatable Read, and violations of Monotonic Atomic View. Jepsen has not yet tested this, but it looks like MariaDB might, with the new flag enabled, offer Snapshot Isolation at REPEATABLE READ. https://lnkd.in/dw_SFhjh https://lnkd.in/dc_9-P26

57

Must See TV. We need Hardware Vendors Intel, AMD, Arm to make cheaper Edge devices with Confidential Computing Chips available. All edge computers in the future should be running Confidential Containers or VMs. If adversary can touch a piece of hardware, they can probably get root access, Secure the system with encryption of not only data but processes running on the system.

2

Observability, as a concept, began gaining traction in 2008. Lew Cirne revolutionized the field by moving all observability data to the cloud. This innovation allowed for the collection and analysis of large volumes of data at low latency, marking the first phase of observability focused on application performance monitoring. Over the years, observability evolved through different phases: ⏩ Phase One: Moving observability to the cloud and focusing on application performance monitoring. ⏩ Phase Two: Consolidating capabilities into a single platform, integrating infrastructure logs, CI/CD, and more. Despite the market's fragmented nature, with the top five vendors holding only 36% of the share, New Relic aimed to unify these elements. ⏩ Phase Three: The current phase, characterized by the emergence of the Intelligent Observability Platform, driven by AI and Big Data. Introducing New Relic AI and Gro Ashan Willy, CEO of New Relic, discussed with us the company's newest innovation under the New Relic AI umbrella: its AI Assistant. The three significant ways AI is transforming observability: ⏩ Democratization: Making observability accessible to more users through a Google-like UI, enabling plain English queries instead of complex query languages. ⏩ AI Ops: Enhancing predictive analysis and reducing false positives, leading to more accurate and actionable insights. ⏩ End-to-End Monitoring: Extending observability to cover AI components within applications, ensuring comprehensive monitoring from user experience to backend processes. Watch the complete interview here: https://lnkd.in/gnAqAXtF

50

Nightmare fuel: imagine Google Cloud deleting not just your data, but your entire account including backups...across 2 geographic regions! This is why I've been looking at external backup solutions for GCP and Google Drive, as expensive as this is. "Google Cloud is supposed to have safeguards that don't allow account deletion, but none of them worked apparently, and the only option was a restore from a separate cloud provider (shoutout to the hero at UniSuper who chose a multi-cloud solution)." #BusinessContinuity #DataSecurity #CloudComputing

8

1 Comment

The next big thing will be #MultiAI. #EnsembleLearning services will take models like Gemini (Palm2), ChatGPT (GPT 4), Meta AI (Llama 3) etc and use voting (bagging), weighted voting (boosting), or meta classifying (stacking) to create better #AI responses to prompts.

1

Holy $#!+, this is HUGE. I can't stress this enough. every single company should be implementing this as soon as possible. That root account has long been a thorn in our risk registers. Side note: One interesting thing that stood out to me, the article specifically names how the security team needs access to the root account, with no mention of devops/platform/SRE teams. I only call it out because this is a common argument I have at organizations. Who owns and is responsible for the cloud environments. This is the first time I've seen AWS call out specific teams with an ownership context like this. Disclaimer: I'm not saying it must be either way. It depends on the company, their priorities, and (unfortunately) egos. Just highlighting the interesting bit.

20

10 Comments