Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cloud Security Posture Management: From Misconfigurations to Attack Paths

bugbunny.ai | blog | #cloud | #cloud-security | #misconfiguration | #governance | #iam | #cspm | #attack-paths

Summary

CSPM done well: stop counting misconfigurations and prioritize those combining public access, broad IAM and sensitive data into real attack paths—with owner context and exception expiry.
Published
Collected

original ↗

Related coverage

blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
blog · wiz.io
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz Research analyzes NordStellar logs to map credentials harvested by infostealers like Lumma and RedLine, showing how stolen keys and tokens unlock AWS, Azure, GitHub, and AI platforms.
blog · wiz.io
Wiz Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026
Wiz earned Leader status in Forrester's Q3 2026 Proactive Security Platforms Wave, scoring 5.0/5.0 on 8 of 21 criteria, including cloud visibility, exposure validation, and remediation augmentation.
blog · wiz.io
A security community success story of mitigating a misconfiguration
The story of fixing a common misconfiguration: GitHub Actions OIDC trust policies missing their 'sub' condition let anyone assume AWS roles, until coordinated research pushed defaults to change.
blog · netspi.com
Overcome Cloud Security Challenges with Purpose-Built Cloud Penetration Testing
Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.
blog · netspi.com
Your Cloud Assets are Probably Not as Secure as You Think They Are
Gartner attributes up to 95% of cloud breaches to human configuration errors; NetSPI catalogs usual suspects like missing MFA, cloud-on-prem integration, and over-permissioned accounts.
back