Category Archives: Amazon Web Services (AWS)

Financial system not keeping up with cyberthreats, new report says

Posted on by

Four years after the biggest bank hack ever, the global financial system remains vulnerable to cyberattacks that could cause severe disruptions, according to a report Wednesday that draws advice from government officials, the financial industry and other experts. The assessment from the Carnegie Endowment for International Peace and the Word Economic Forum is the culmination of years of work, with touchstones ranging from the 2016 Bangladesh Bank heist where hackers made off with $81 million to a recent Chilean bank ransomware attack that shut down all of its branches. “Our big concern is that if you look at what’s happened during the pandemic, but even before with the escalating threat that’s targeting the financial system from the Bangladesh incident to the Chile outage back in September, we’re clearly not keeping up with the threat and how quickly it’s evolving,” said Tim Maurer, director of Carnegie’s Cyber Policy Initiative. “The government and industry need […]

The post Financial system not keeping up with cyberthreats, new report says appeared first on CyberScoop.

Continue reading Financial system not keeping up with cyberthreats, new report says→

Sneaky recon on roster of AWS users is possible, Unit 42 says

Posted on by

Knowing exactly who manages a certain cloud service can be valuable information for malicious hackers, and a cybersecurity company says it has found that kind of weakness in products run by one of the biggest cloud providers. More than 20 application programming interfaces (API) associated with 16 Amazon Web Services products can be abused to give up basic information about users and their roles, according to Unit 42, the research arm of cybersecurity giant Palo Alto Networks. “A malicious actor may obtain the roster of an account, learn the organization’s internal structure” and then perhaps “launch targeted attacks against individuals,” Unit 42 researcher Jay Chen says in a report released Tuesday morning. Palo Alto Networks says AWS gave permission to release the research. The problem is within a feature that validates “resource-based policies” for things like the commonly used Amazon Simple Storage Service (S3), Unit 42 says. A resource-based policy is basically a […]

The post Sneaky recon on roster of AWS users is possible, Unit 42 says appeared first on CyberScoop.

Continue reading Sneaky recon on roster of AWS users is possible, Unit 42 says→

Using AWS Serverless Architecture to Collect JumpCloud Directory Insights Data

Posted on by

We released the Directory Insights Serverless app to empower JumpCloud admins to expand the use and duration of their event log data.
The post Using AWS Serverless Architecture to Collect JumpCloud Directory Insights Data appeared first on JumpCloud.
T… Continue reading Using AWS Serverless Architecture to Collect JumpCloud Directory Insights Data→

Twilio breach spotlights struggle to keep corporate software kits out of the wrong hands

Posted on by

The security team at Twilio, a cloud communications company that claimed over $1 billion in revenue last year, could breathe a sigh of relief on Sunday night. Earlier in the day, someone had manipulated the code in a software product that Twilio customers use to route calls and other communications. The breach resembled a Magecart-style attack that skims websites for users’ financial data. Twilio cleaned up the code hours later, and said there was no sign the attackers had accessed customer data. But the damage could have been worse if the attack had been targeted, multiple security experts told CyberScoop. With access to the code, which was sitting in an unsecured Amazon cloud storage service known as an S3 bucket, the attackers could have conducted phishing attacks or distributed malware through the platform, according to Yonathan Klijnsma, head of threat research at security company RiskIQ. Dave Kennedy, founder of cybersecurity […]

The post Twilio breach spotlights struggle to keep corporate software kits out of the wrong hands appeared first on CyberScoop.

Continue reading Twilio breach spotlights struggle to keep corporate software kits out of the wrong hands→

Between the Lines of AWS Directory Service Pricing

Posted on by

AWS offers many IAM solutions, but the cost of features and the infrastructure necessary to implement them can add up.
The post Between the Lines of AWS Directory Service Pricing appeared first on JumpCloud.
The post Between the Lines of AWS Directory … Continue reading Between the Lines of AWS Directory Service Pricing→

One User Account for Both AWS and GCP

Posted on by

Use a cloud directory service to provide one user account for AWS and GCP, even if you’re an AD-centric organization.
The post One User Account for Both AWS and GCP appeared first on JumpCloud.
The post One User Account for Both AWS and GCP appea… Continue reading One User Account for Both AWS and GCP→