Microsofts große Sicherheitsversprechen? Jürgen Schmidt, Leiter von heise Security, hält sie für leere Worte! 
Zum Kommentar: https://heise.de/-10505985?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon
#cloudsecurity
0 posts0 participants0 posts today
Microsoft outsourced U.S. government cloud support to China - because nothing says "secure government systems" like having sensitive data maintained overseas 
Their competitors AWS, Google, and Oracle all avoid China-based support for federal contracts. Sometimes knowing which clouds to avoid IS the strategy 
it.slashdot.orgMicrosoft Used China-Based Support for Multiple U.S. Agencies, Potentially Exposing Sensitive Data - SlashdotMicrosoft used China-based engineering teams to maintain cloud computing systems for multiple federal departments including Justice, Treasury, and Commerce, extending the practice beyond the Defense Department that the company announced last week it would discontinue. The work occurred within Micros...
https://www.europesays.com/2236616/ Japan Cyber Security Market Trends Analysis Report 2025-2030 #CloudSecurity #CriticalSectors #CyberSecurity #CyberThreats #DigitalInfrastructure #japan #MarketDynamics #MarketGrowth #OrganizationSize
AI scraping bots stealing your data? John Graham-Cumming of Cloudflare explains on Intelligent Machines how they’re blocking these bots to protect content. Listen & subscribe: https://twit.tv/shows/intelligent-machines/episodes/826 #AI #CloudSecurity
https://www.europesays.com/2169664/ Citrix Parent CEO Krause Leaves DOGE, US Treasury Posts #ApplicationAndPlatformSecurity #CloudPlatforms #CloudSecurity #CloudSoftware #DepartmentOfGovernmentEfficiency #DesktopClients #doge #ElonMusk #EndpointSecurity #ManagedSecurity #Musk #Notebooks
New Open-Source Tool Spotlight
gVisor: a user-space application kernel designed for container isolation. It mimics a Linux kernel interface while being written in Go for memory safety, running in user space. Ideal for sandboxing workloads in Docker or Kubernetes. #Containers #Sandbox
Project link on #GitHub 
https://github.com/google/gvisor
#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity
— 
P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking 
ICYMI: DomainTools Investigations released new research this week!
Skeleton Spider (aka FIN6) is leveraging trusted cloud services like AWS to deliver malware through fake job applications and resume-themed phishing campaigns.
Learn how this financially motivated group is:
Exploiting cloud infrastructure to evade detectionUsing social engineering to lure victimsBuilding resilient, scalable malware delivery systems
Read the full analysis here: https://dti.domaintools.com/skeleton-spider-trusted-cloud-malware-delivery/?utm_source=Mastodon&utm_medium=Social&utm_campaign=Skeleton-Spider
DomainTools Investigations | DTI · Eggs in a Cloudy Basket: Skeleton Spider’s Trusted Cloud Malware Delivery - DomainTools Investigations | DTIDiscover how the FIN6 cybercrime group, also known as Skeleton Spider, leverages trusted cloud services like AWS to deliver stealthy malware through fake job applications and resume-themed phishing campaigns. Learn about their tactics, infrastructure, and how to defend against these evolving threats.
Cybercrime group FIN6 (aka Skeleton Spider) is leveraging trusted cloud services like AWS to deliver malware through fake job applications.
Our latest analysis breaks down: How attackers use LinkedIn & Indeed to build trust The use of resume-themed phishing lures Cloud-hosted infrastructure that evades detection The delivery of the More_eggs backdoor via .LNK files Key defense strategies for recruiters and security teams
This campaign is a masterclass in low-complexity, high-evasion phishing
Read the full breakdown: https://dti.domaintools.com/skeleton-spider-trusted-cloud-malware-delivery/?utm_source=Mastodon&utm_medium=Social&utm_campaign=Skeleton-Spider
New Open-Source Tool Spotlight
Kubernetes History Inspector (KHI) is an agentless log viewer built for visualizing Kubernetes audit logs. Its timeline-based log analysis and resource relationship diagrams simplify cluster troubleshooting—no complex setups or commands required. #Kubernetes #Observability
Project link on #GitHub https://github.com/GoogleCloudPlatform/khi
#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity
— P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking
New Open-Source Tool Spotlight
tfmcp simplifies Terraform management by letting AI assistants like Claude Desktop handle config, plans, and state via the Model Context Protocol (MCP). Built with Rust, it offers robust security, Docker support, and detailed analysis. 
#Terraform #DevOps
Project link on #GitHub https://github.com/nwiizo/tfmcp
#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity
— P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking
New Open-Source Tool Spotlight
CVEMap by ProjectDiscovery simplifies vulnerability intelligence with a CLI tool that maps CVEs to EPSS, KEV, CPE, GitHub PoCs, and more. Customizable filters, JSON output, and integration-ready. Requires Go 1.21. #cybersecurity #opensource
Project link on #GitHub https://github.com/projectdiscovery/cvemap
#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity
— P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking
Microsoft Copilot for SharePoint just made recon a whole lot easier.
One of our Red Teamers came across a massive SharePoint, too much to explore manually. So, with some careful prompting, they asked Copilot to do the heavy lifting...
It opened the door to credentials, internal docs, and more.
All without triggering access logs or alerts.
Copilot is being rolled out across Microsoft 365 environments, often without teams realising Default Agents are already active.
That’s a problem.
Jack, our Head of Red Team, breaks it down in our latest blog post, including what you can do to prevent it from happening in your environment.
Read it here: https://www.pentestpartners.com/security-blog/exploiting-copilot-ai-for-sharepoint/
A great initiative promoting default security settings for cloud services, independent of cloud vendors.
Cloud Security By DefaultCloud Security By DefaultThe Cloud Security by Default initiative brings CSPs and their customers together in two-way conversations to validate, challenge, and support principles to establish out-of-the-box CSP offerings with appropriate baseline security by default.
Hot take, If you develop for cloud environments you need to get used to a default deny on egress and only allow dependencies to be pulled during the build phase. You should know exactly what is talking to where and why. allow all on egress is the equivalent to I chmod 777'd it and it works so whatever...
BIG NEWS: I'm launching Entra.Chat - the podcast identity pros have been waiting for!
After years in the identity trenches, I've seen a lot - the midnight calls, the authentication puzzles, and those "how is this even possible?" moments.
That's why I created EntraChat - to share the REAL stories behind Microsoft Entra deployments that you won't find in documentation.
My first episode drops TODAY with identity wizard Ben Wolfe, who reveals how his team migrated 700 apps and 30,000 users from Okta to Microsoft Entra in just 90 days (while implementing Windows Hello for Business simultaneously!)
I've already recorded amazing conversations with identity leaders who've solved problems you're probably facing right now. Their candid insights and battle-tested solutions might just save your next deployment!
Upcoming episodes include conversations with
Kuba Gretzky - Creator of EvilGinx Martin Sandren - Product leader at Ikea Dhanyah Krishnamoorthy - Product Manager, Microsoft Entra for Connect Sync and Cloud Sync Samantha 
Kloos-Kilkens - Nathan McNulty - Fountain of knowledge on all things Microsoft Security
Who's ready to level up their identity knowledge?
Drop a 
if you're as excited about this as I am!
Subscribe with your favourite podcast player:
Apple Podcast - https://podcasts.apple.com/us/podcast/entra-chat/id1801200012
Spotify - https://open.spotify.com/show/2lJSWBTmMWWn4f9u75JvHY
YouTube - https://www.youtube.com/@merillx/podcasts
Pocketcast - https://pca.st/10oii6uv
Overcast - https://overcast.fm/itunes1801200012
Other podcast apps (rss) - https://api.substack.com/feed/podcast/1804560/private/17af4edf-5946-4494-a05a-ac8693ba426d.rss
Episode 1: https://entra.news/p/from-okta-to-entra-migrating-700
Encrypt Your Cloud Data with Cryptomator: Security 101
https://neat.tube/videos/watch/b1ff1f74-e825-4568-9acd-f29a56703439
How does a single nation take on some of the largest crypto networks in the world?
According to blockchain tracking firms and cybersecurity researchers, North Korea is linked to one of the most significant crypto hacks of recent times. The attack, believed to involve sophisticated tactics, siphoned off millions in digital assets. This isn’t the country's first foray into crypto theft; North Korean hacking groups, most notably Lazarus Group, have been implicated in multiple similar exploits.
Blockchain activity linked to the breach reveals well-coordinated operations leveraging vulnerabilities in decentralized finance (DeFi) protocols and cryptocurrency exchanges. These groups often use techniques like phishing, social engineering, or exploiting weak smart contract security to gain access to funds. Once stolen, the assets are laundered through complex methods such as chain-hopping — moving funds across multiple blockchains — or using mixer services to obscure transaction history.
The United Nations has long accused North Korea of using stolen cryptocurrency to fund its missile programs, bypassing global sanctions. With estimates suggesting billions have been lost to these operations over the years, this latest hack adds to a growing pattern that highlights weaknesses in crypto security.
For crypto users and developers, this serves as another wake-up call about the critical need for robust security measures, especially as attackers continue to evolve their methods.
#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity
— P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking
Big News: Introducing Stratoshark – "Wireshark for the Cloud"!
Today, we're thrilled to unveil Stratoshark, the next evolution in system visibility, designed for cloud-native environments. Built on the open-source legacy of Wireshark and Falco, Stratoshark delivers unmatched cloud observability with tools you already know and trust.
With Stratoshark, devops teams can:
• Analyze cloud system calls and logs with Wireshark-like granularity.
• Bridge the visibility gap between traditional networks and dynamic cloud workloads.
• Combine Wireshark's rich insights with Falco's real-time cloud security.
Download now and learn more: https://stratoshark.org/
#Stratoshark #Wireshark #CloudSecurity #Falco #Sysdig @sysdig
Private Internet Access VPN Review: How Good Is PIA VPN? – Source: www.techrepublic.com https://ciso2ciso.com/private-internet-access-vpn-review-how-good-is-pia-vpn-source-www-techrepublic-com/ #PrivateInternetAccessvpnreview #rssfeedpostgeneratorecho #SecurityonTechRepublic #SecurityTechRepublic #CyberSecurityNews #CloudSecurity #Security #piavpn #VPN
CISO2CISO.COM & CYBER SECURITY GROUP · Private Internet Access VPN Review: How Good Is PIA VPN? – Source: www.techrepublic.comSource: www.techrepublic.com - Author: Luis Millares We may earn from vendors via affiliate links or sponsorships. This might affect product placement
★ Do you get excited or upset about AWS SCPs, or GCP Org Policies?
★ Do you have experience solving cloud security challenges to enable software engineering teams?
★ Do you downplay your cloud security knowledge but actually you know a lot of niche oddities of cloud IAM?
★ Do you like working in diverse security teams that care about your wellbeing?
★ Do you want to get paid to work on cloud security for one of the most sophisticated AWS environments in the world?
This may be the right role for you! I'm hiring a Cloud Security Engineer (L5) for Netflix Cloud Security.
https://explore.jobs.netflix.net/careers/job/790300140296
#Hiring #CloudSecurity
explore.jobs.netflix.netSecurity Engineer (L5), Cloud Security | USA - Remote | NetflixYou have a broad understanding of AWS or GCP security fundamentals, particularly cloud IAM (hey you! don't disqualify yourself by underestimating your expertise) You have experience collaborating with product teams to understand their business needs and designing appropriate cloud security solutions to address them. You can communicate good, to convey complex technical issues cross-functionally through written and verbal communication You take a pragmatic approach by engaging transparently with the nuances and tradeoffs of security risk You believe a diverse and inclusive team is a critical aspect of a sustainable and effective work environment You thrive by identifying high-leverage work and doing it without explicit direction Experience securing challenging 3rd-party cloud infrastructure access patterns such as vendor integrations Experience defining insightful metrics to guide our cloud security posture or progress. GCP security expertise