Category Archives: Amazon Web Services (AWS)

Senate hearing on SolarWinds hack lays bare US shortcomings, remaining mysteries

Posted on by

A host of federal government policy failures contributed to the rippling damage of the SolarWinds hack, leaders of cyber firms told a Senate panel on Tuesday, with even lawmakers saying Congress must do more to prevent a repeat. More than two months after the hack became public, the wide-ranging Senate Select Committee on Intelligence hearing committee demonstrated that the U.S. government, the private sector and digital incident responders still are wrestling with the ramifications of an suspected Russian espionage campaign that leveraged the federal contractor SolarWinds. A number of big questions remain: SolarWinds still hasn’t determined how the hackers originally got into its systems, nobody has fully settled debates on whether the incident amount to espionage, or something worse, and suspicions abound that more victims remain unrevealed. “It has become clear that there is much more to learn about this incident, its causes, its scope and scale, and where we […]

The post Senate hearing on SolarWinds hack lays bare US shortcomings, remaining mysteries appeared first on CyberScoop.

Continue reading Senate hearing on SolarWinds hack lays bare US shortcomings, remaining mysteries→

ThreatStack Brings Security Observability to AWS EC2

Posted on by

ThreatStack announced this week that it has integrated its observability platform for tracking cybersecurity events with the EC2 cloud service from Amazon Web Services (AWS). Chris Ford, vice president of product for ThreatStack, said the company’s na… Continue reading ThreatStack Brings Security Observability to AWS EC2→

Trend Micro Employs Serverless Computing to Scan Cloud Files for Malware

Posted on by

Trend Micro has developed an antimalware tool, based on a lightweight, serverless computing framework, that can scan files for malware before they are stored in cloud services. Cloud storage services have become a significant attack vector, as cybercr… Continue reading Trend Micro Employs Serverless Computing to Scan Cloud Files for Malware→

Financial system not keeping up with cyberthreats, new report says

Posted on by

Four years after the biggest bank hack ever, the global financial system remains vulnerable to cyberattacks that could cause severe disruptions, according to a report Wednesday that draws advice from government officials, the financial industry and other experts. The assessment from the Carnegie Endowment for International Peace and the Word Economic Forum is the culmination of years of work, with touchstones ranging from the 2016 Bangladesh Bank heist where hackers made off with $81 million to a recent Chilean bank ransomware attack that shut down all of its branches. “Our big concern is that if you look at what’s happened during the pandemic, but even before with the escalating threat that’s targeting the financial system from the Bangladesh incident to the Chile outage back in September, we’re clearly not keeping up with the threat and how quickly it’s evolving,” said Tim Maurer, director of Carnegie’s Cyber Policy Initiative. “The government and industry need […]

The post Financial system not keeping up with cyberthreats, new report says appeared first on CyberScoop.

Continue reading Financial system not keeping up with cyberthreats, new report says→

Sneaky recon on roster of AWS users is possible, Unit 42 says

Posted on by

Knowing exactly who manages a certain cloud service can be valuable information for malicious hackers, and a cybersecurity company says it has found that kind of weakness in products run by one of the biggest cloud providers. More than 20 application programming interfaces (API) associated with 16 Amazon Web Services products can be abused to give up basic information about users and their roles, according to Unit 42, the research arm of cybersecurity giant Palo Alto Networks. “A malicious actor may obtain the roster of an account, learn the organization’s internal structure” and then perhaps “launch targeted attacks against individuals,” Unit 42 researcher Jay Chen says in a report released Tuesday morning. Palo Alto Networks says AWS gave permission to release the research. The problem is within a feature that validates “resource-based policies” for things like the commonly used Amazon Simple Storage Service (S3), Unit 42 says. A resource-based policy is basically a […]

The post Sneaky recon on roster of AWS users is possible, Unit 42 says appeared first on CyberScoop.

Continue reading Sneaky recon on roster of AWS users is possible, Unit 42 says→

Using AWS Serverless Architecture to Collect JumpCloud Directory Insights Data

Posted on by

We released the Directory Insights Serverless app to empower JumpCloud admins to expand the use and duration of their event log data.
The post Using AWS Serverless Architecture to Collect JumpCloud Directory Insights Data appeared first on JumpCloud.
T… Continue reading Using AWS Serverless Architecture to Collect JumpCloud Directory Insights Data→

Twilio breach spotlights struggle to keep corporate software kits out of the wrong hands

Posted on by

The security team at Twilio, a cloud communications company that claimed over $1 billion in revenue last year, could breathe a sigh of relief on Sunday night. Earlier in the day, someone had manipulated the code in a software product that Twilio customers use to route calls and other communications. The breach resembled a Magecart-style attack that skims websites for users’ financial data. Twilio cleaned up the code hours later, and said there was no sign the attackers had accessed customer data. But the damage could have been worse if the attack had been targeted, multiple security experts told CyberScoop. With access to the code, which was sitting in an unsecured Amazon cloud storage service known as an S3 bucket, the attackers could have conducted phishing attacks or distributed malware through the platform, according to Yonathan Klijnsma, head of threat research at security company RiskIQ. Dave Kennedy, founder of cybersecurity […]

The post Twilio breach spotlights struggle to keep corporate software kits out of the wrong hands appeared first on CyberScoop.

Continue reading Twilio breach spotlights struggle to keep corporate software kits out of the wrong hands→

Between the Lines of AWS Directory Service Pricing

Posted on by

AWS offers many IAM solutions, but the cost of features and the infrastructure necessary to implement them can add up.
The post Between the Lines of AWS Directory Service Pricing appeared first on JumpCloud.
The post Between the Lines of AWS Directory … Continue reading Between the Lines of AWS Directory Service Pricing→