RunAsCloud
Advanced Cloud Consultants
Pritunl is an open source OpenVPN and IPSec solution that comes with a somewhat popular VPN client. Pritunl Zero fills in a few more gaps by providing zero trust access to SSH and Web Services similar to products such as Akamai EAA and Zscaller. I installed an individual server using this guide. It was relatively […]
Automation, DevOps, Engineering, Uncategorized
An Interview with Tricia Ferreira, VP, Technology Product Management at World Fuel Services – on asking the right questions, leveraging expert resources, and inspiring innovation. Originally from Trinidad & Tobago, Tricia moved to the United States and studied Computer Science at FIU. She moved to Atlanta and held prominent leadership positions in Technology at GE. […]
Interview, Product, Technology
In two previous articles, I described how the Capital One breach took advantage of an EC2-specific function to obtain AWS credentials which were then used to obtain multiple files containing sensitive information. If you haven’t already done so, I’d encourage you to read parts one and two before continuing. You might also want to pull up the complaint for […]
Engineering, Journal, Security
In a previous post, I mentioned that the attack vector for the Capital One breach specifically targeted an EC2 feature. In this post, I’ll give my educated guesses about how the attack actually worked. [Note 1: if anyone happens to have any of the contents of the original gist then I’d love to get a look […]
Engineering, Journal, Security
There’s been a ton of coverage of the recently discovered Capital One breach. I’m generally very skeptical when AWS security makes the news; so far, most “breaches” have been a result of the customer implementing AWS services in an insecure manner, usually by allowing unrestricted internet access and often overriding defaults to remove safeguards (I’m […]
Engineering, Journal, Security
Yubi what? A YubiKey is Yubico hardware authentication device designed to achieve secure 2-factor authentication (2FA) for online services like AWS, computer logins, developer tools, password managers and other important data. The YubiKey combines hardware-based authentication and public key cryptography to eliminate account takeovers and provides the extra security you need. YubiKey’s were created by […]
Security, Tutorials
Every morning I try to follow a checklist that I wrote. I read over resumes, check out PRs, check my email accounts, etc… One critical thing I do (or did) was checked to see who forgot to log their hours from the day before (or who left the timer running). Since we are a consultancy, […]
Automation, Engineering, Journal
AWS re:Inforce 2019, the first security-focused AWS event, was held at the Boston Convention and Exposition Center—An incredible 516,000 sq ft modern-art well-architected venue of steel and glass. The event occupied 4 floors with ground 0 being the main expo of vendor booths, buffet lunch, and breakfast meals. They kept the same AWS feel of […]
Engineering, Events, Journal, Security