Have you ever sat in a meeting when someone asks, “Didn’t Alex fix this back in 2015?”, and the room falls silent as people do the mental math on how long it’s been since Alex left the company? Alex left the company years ago, yet his name still guides technical decisions. The Eternal Alex Coefficient (EAC) offers a straightforward coefficient that measures how often an absent employee’s solutions…
I very matter of factly told a colleague that security.txt is a well-known standard but it's not widely used in "major corporations". In the context of our conversation I took "major corporations" to mean financial services. I didn't have the data on hand to back up the claim. I compiled a list of 207 financial services domains 1 . Banks, insurers, pension providers, etc., a bit more…
One of my hobbies is researching covert exfiltration mechanisms that use public cloud services 1 . Public cloud at its core has most service endpoints on the internet. If all you need is a bit of compute talking to some storage, you’d rather not involve the internet at all. Enter private endpoints VPC-only access to managed services. On AWS, you can attach policies to some of them, so only your…
It seems like you're asking me to change my password every x days. I don't think this is a good idea. You're signalling that your authentication and IAM maturity isn't where it should be 1 You don't have to take my word for it. Source Quote NIST 800-63B rev.3 Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers 2…
It all started down at the pub, during a casual, work-adjacent gathering. Someone asked, "Wouldn't it be great if we could easily find all the burger places near here?" A classic question. The kind Google Maps can answer. However, "here" is relative. For the purposes of this, "here" means a Young's pub. The question then becomes, "What if we wanted to find all burger places near…
2025 started with me ripping off the USB port of the left hand side of my redox keyboard. The micro USB cable that connected to my keyboard, had two tiny "hooks". These latch into the arduino USB receiver port. It is apparently a common feature of micro USB cables. After 6 years these hooks decided to detach with the USB port, leaving the arduino USB-less. I built my keyboard a redox in 2018 It…
How many IAM layers exist when accessing an S3 object from within an AWS VPC using an AWS principal? In AWS, even if an identity has the required permissions to access a resource, that does not guarantee the resource will be accessible. There are generally three IAM layers: identity, network (VPC), and resource. The rule of thumb of AWS IAM evaluation logic is that as long as there isn't an…
Sometimes I use a simple mnemonic to evaluate an organisation's cybersecurity maturity. It's not perfect. It’s a useful tool to spark meaningful discussions about their security posture. 1 It boils down to asking one question. How does an organisation decide what technical controls to implement? In other words, what drives the decision to enable a mitigation? There are roughly three…
Check out Clotho and a working example using Squid In the realm of public cloud computing, the necessity of utilizing public endpoints is an inherent characteristic — it's what defines the "public" in public cloud. Consider this scenario: It's Monday, and you're logging into Outlook on the web (OWA) to access your work email. Interestingly, the same URL that grants you access to…
I'm writing an authorisation library for AWS in Rust and Python. I want to parse requests sent to AWS public endpoints, say s3.amazonaws.com and figure out if I should forward them or not. Instead of writing my own proxy, 1 I thought I'd integrate my library with Squid proxy . Squid was initially released in 1996. Written in C++, it has survived the test of time, in that it is still…
I stumbled upon this post on the AWS subreddit: How are you mitigating the risk of a rogue AWS engineer accessing our data or damaging the RDS instance? The author wants to address the CISO's concerns about this scenario. The top responses dismissed the concern. This sounds like more of an issue with your leadership not understanding how AWS works[...] and Honestly, this sounds like more of a…
With my browser setup I don't get to see the GDPR cookie banners . You can achieve the same by using ublock origin . After an update, my default browser changed. I opened a link to a news website, and there it was, the cookie banner, asking me if I want to accept sharing my data with 1174 partners 1 . That's a lot of partners. There's probably some website out there that has more…
You can solve any problem in an enterprise setting by assigning it to the team that is not in the meeting. You can potentially extend this to settings other than meetings, as long as you get agreement with the rest of the participants that the problem sits with team X. There are certain quorum criteria that you need to meet, depending on the size of the problem. For instance, a problem that…
I stumbled upon lottery statistics which are very useful if you have never come across the gambler's fallacy . On the UK national lottery you pick 6 numbers out of 59 (1-59). Of these 6 numbers are drawn. I wondered how this plays out in other lottery-like games, and how do I get to verify these numbers. Verify in the sense for example, that the mean of the uniform distribution of lottery…
Race Conditions in Cloud Security Posture Management Race conditions - the archenemy of all detective and corrective controls. Cloud Security Posture Management (CSPM) a well established market with a market cap north of US$ 4 billion , including large SaaS products like Prisma and Wiz to open source solutions like Cloud Custodian. Most enterprises with a cloud presence will have some form of a…
I like Medium. It's where I started eponymously blogging. Medium publications are great and the workflow is pretty neat. Lots of good content and publications are still in Medium. But I really like tables. Maybe it's because I've spent a part of my life in spreadsheets. Tables are probably one of Markdown's pain points. There is no good way to style a table in Markdown. Not…
The shared responsibility of credential stuffing If your account falls victim to a credential stuffing attack, whose responsibility is it ? Drawing a parallel from the shared responsibility model of cloud service providers like AWS , credential stuffing attacks have a not so well defined responsibility model. Whose responsibility is it if your account on a hosted provider gets breached ? Well if…
Querying and Visualising OctoDNS records with Neo4j Visualising DNS records with Neo4j OctoDNS provides a toolset for managing DNS records across multiple providers. Built by Github and using a typical YAML structure, to describe what a DNS zone should look like. The example taken from the getting-started section of the repo, describes what an A record at example.com looks like. --- '' : ttl : 60…
The economics of credential stuffing attacks If you run a website with a login form, you have either experienced a credential stuffing attack or it has gone undetected. The economics of credential stuffing attacks If you run a website with a login form, you have either experienced a credential stuffing attack or it has gone undetected . Briefly a credential stuffing attack is when someone,…
Build your own keyboard Out of all the peripherals out there, I like keyboards the most. Assemble your own keyboard Out of all the peripherals out there, I like keyboards the most. I like split keyboards and I like building keyboards. This is a guide on how you too, can build a keyboard. Specifically I'm going to walk you through how to build a redox, split keyboard. You will need to know how…