PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Securing Cloud Databases: Best Practices with ClickHouse and Wiz

wiz.io | blog | #cloud | #cloud-security | #data-exposure | #best-practices | #misconfiguration | #clickhouse | #database-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Security best practices for cloud-hosted ClickHouse databases—built-in controls, hardening, and continuous monitoring—prompted by the Wiz-found DeepSeek exposure and 30k+ internet-reachable instances.
Published
Collected

Related coverage

blog · wiz.io
Setting secure defaults on AWS and avoiding misconfigurations
Wiz's Scott Piper explains enforcing secure AWS defaults with SCPs—blocking public S3 buckets, disabling risky features and protecting the guardrails themselves—with rollout checks.
blog · hackenproof.com
New Discovery: Nokia left its cloud environment open, config details exposed
HackenProof disclosed that Nokia left one of its cloud environments open to the internet, exposing configuration details.
blog · hunt.io
Over 68 GB of Philippine Overseas-Employment Database Backups Copied From an Exposed Staging Server
An exposed staging server at UpCloud revealed a completed 68 GB copy of 27 Philippine overseas-employment database backups, a rebranded GodPotato privilege escalation tool, and the operator's own transfer logs.
blog · vercel.com
Mitigating Denial of Wallet risks with Vercel
Protect against Denial of Wallet (DoW) attacks with Vercel. DoW exploits cloud scalability to inflate costs. Vercel provides solutions like budget alerts, spend limits, and anomaly detection to safeguard workloads and maintain financial stability.
blog · vercel.com
Introducing Vercel Firewall and Vercel Secure Compute
Vercel Secure Compute and Vercel Firewall for enhanced protection of your applications on the frontend cloud
blog · netspi.com
When Databases Attack: SQL Server Express Privilege Inheritance Issue
By default, SQL Server Express grants connect rights to BUILTIN\Users, letting any authenticated domain user reach instances with TCP listeners enabled. The author details the attack path and fixes.
Back