Week Roundup #4: July 8th - July 14th

Quick roundup of the ~security~ stuff I’ve been working on in the past week!

Getting rid of the CSS this week, hate setting it up and this looks so much cooler

Best [placeholder] of the Week

Album of the week:

• Portishead - Third exceeded any expectations I had of what post-Dummy Portishead would be like. Way more interesting than I expected, and no song has pulled the carpet from underneath me more than Silence

Article of the week:

• Marco Lancini’s ‘What to look for when reviewing a company’s infrastructure’ is one of the most incredibly methodical and pragmatic design review approaches I’ve ever read. As a security engineer that will soon be having to review a lot of brand new infrastructure (...) this guide will likely be my north star for how to approach this systematically.

Purchase of the week:

• I respect the fuck out of consumer tech that solves one problem really well, and in my conscious efforts this year to untether myself from my phone and computer I’ve purchased a second-hand iPod Nano. This thing is the shit, haven’t listened to so much new music in months

Week Roundup

This was another unbelievably hectic but exciting week, and with mounting pressure in my current role I've not had as much free time to work on personal projects. Nonetheless I've got to read some interesting articles, and work on one cool project that should set me up well for future security adventures!

Projects:

• Writing up a personal infrastructure design review process for GCP environments

  • Off the back of Marco Lancini’s infrastructure review guide I’ve been working to build out my own personal approach that granularly reviews GCP infrastructure environments.
  • For the most part this has been an exercise in identifying all of the GCP services available to a. secure cloud services, b. secure workloads, and c. assess the security of the cloud holistically
  • There’s a lot of other blogs available in this area that it would be good to spend time with to enrich this approach

Articles and Videos

• <article> What to look for when reviewing a company’s infrastructure

  • Nothing more to add than what’s already said, just a great guide

• <article> Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery

  • This is such a niche attack I love it, plus CSPT2CSRF looks badass
  • The slide deck for the presentation by Maxence Schmitt at OWASP AppSec in Lisbon helps to flesh out exactly how this attack works
  • Really want to go hunting for some CSPT’s now

• <article> Catching Compromised Cookies at Slack

  • Idea of monitoring for last access timestamp in a presented cookie is really cool, goes beyond the technical and actually considers how an attacker would practically use a stolen cookie
  • Given the propensity of false-positives, I’m interested to see how this could rollout with invalidating sessions marked as potentially forked

• <tool> domain-protect-gcp

  • This is a cool open-source tool for detecting vulnerable domain records in GCP
  • Need to learn more about subdomain delegations and how takeovers can occur for these

• <article> Cloud Threat Landscape by Wiz

  • Nice little database of cloud security measures to prevent attacks in the cloud
  • Links off really well to the MITRE D3FEND matrix
  • Would be good to spend some time with this and the cloud security review process I’m building to start some heatmapping around the D3FEND matrix