Staying Off the Hamster Wheel of Cloud Security Pain

Explore the balance of AI and human expertise in cybersecurity, addressing both benefits and limitations for effective security strategies.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

Reviews the Georgia Tech 2013 cyber threat forecast: cloud botnets, mobile browser and wallet flaws, malware obfuscation, counterfeit hardware in the supply chain, and healthcare data risks.

After a dull conference, the author concludes cloud pentesting is fundamentally the same as traditional testing: virtualized or shared, the underlying technology and security controls hardly change.

I recently had the opportunity to review an article by Michael Koploy of Software Advice titled "HHS Data Tells the True Story of HIPAA Violations in the Cloud".