Cloud Security Alliance News Clipping Site

Tag: attack surface

  • Hacker News: Refresh vs. Long-lived Access Tokens (2023)

    —

    by

    system automation
    in

    Source URL: https://grayduck.mn/2023/04/17/refresh-vs-long-lived-access-tokens/ Source: Hacker News Title: Refresh vs. Long-lived Access Tokens (2023) Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text discusses the differences between long-lived access tokens and a combination of long-lived refresh tokens with short-lived access tokens, particularly in the context of OAuth 2.0. It highlights the security benefits of…

  • Hacker News: Listen to the whispers: web timing attacks that work

    —

    by

    system automation
    in

    Source URL: https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work Source: Hacker News Title: Listen to the whispers: web timing attacks that work Feedly Summary: Comments AI Summary and Description: Yes **Summary:** This text introduces novel web timing attack techniques capable of breaching server security by exposing hidden vulnerabilities, misconfigurations, and attack surfaces more effectively than previous methods. It emphasizes the practical…

  • CSA: How Can You Strengthen Google Workspace Security?

    —

    by

    system automation
    in

    Source URL: https://www.valencesecurity.com/resources/blogs/why-application-specific-passwords-are-a-security-risk-in-google-workspace Source: CSA Title: How Can You Strengthen Google Workspace Security? Feedly Summary: AI Summary and Description: Yes Summary: The text discusses the security risks related to Application-Specific Passwords (ASPs) in Google Workspace, emphasizing their vulnerabilities and the need for stronger authentication methods. It provides practical security tips to mitigate the risks associated…

  • Cloud Blog: Cloud CISO Perspectives: The high security cost of legacy tech

    —

    by

    system automation
    in

    Source URL: https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-the-high-security-cost-of-legacy-tech/ Source: Cloud Blog Title: Cloud CISO Perspectives: The high security cost of legacy tech Feedly Summary: Welcome to the first Cloud CISO Perspectives for November 2024. Today I’m joined by Andy Wen, Google Cloud’s senior director of product management for Google Workspace, to discuss a new Google survey into the high security…

  • Hacker News: A New Era of macOS Sandbox Escapes: Overlooked Attack Surface, 10+ New Vulns

    —

    by

    system automation
    in

    Source URL: https://jhftss.github.io/A-New-Era-of-macOS-Sandbox-Escapes/ Source: Hacker News Title: A New Era of macOS Sandbox Escapes: Overlooked Attack Surface, 10+ New Vulns Feedly Summary: Comments AI Summary and Description: Yes Summary: The blog post discusses a series of novel sandbox escape vulnerabilities discovered in macOS, including various CVEs that expose how remote code execution (RCE) within a…

  • Hacker News: Edge Scripting: Build and run applications at the edge

    —

    by

    system automation
    in

    Source URL: https://bunny.net/blog/introducing-bunny-edge-scripting-a-better-way-to-build-and-deploy-applications-at-the-edge/ Source: Hacker News Title: Edge Scripting: Build and run applications at the edge Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text introduces Bunny Edge Scripting, a new serverless JavaScript platform designed for deploying and running applications globally, with a focus on simplifying the development process and enhancing performance at…

  • CSA: Modernization Strategies for Identity and Access Management

    —

    by

    system automation
    in

    Source URL: https://www.britive.com/resource/blog/identity-access-management-modernization Source: CSA Title: Modernization Strategies for Identity and Access Management Feedly Summary: AI Summary and Description: Yes **Summary:** The text emphasizes the critical role of modern identity and access management (IAM) and privileged access management (PAM) in enhancing cybersecurity, particularly in the context of cloud adoption and infrastructure modernization. It argues for…

  • Hacker News: RCE Vulnerability in QBittorrent

    —

    by

    system automation
    in

    Source URL: https://sharpsec.run/rce-vulnerability-in-qbittorrent/ Source: Hacker News Title: RCE Vulnerability in QBittorrent Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text details significant security vulnerabilities present in the qBittorrent application, particularly involving SSL certificate validation and potential for remote code execution (RCE) through intentionally manipulated update processes. This information is highly relevant for professionals…

  • CSA: Zero Standing Privileges: The Essentials

    —

    by

    system automation
    in

    Source URL: https://www.cyberark.com/resources/blog/zero-standing-privileges-the-essentials Source: CSA Title: Zero Standing Privileges: The Essentials Feedly Summary: AI Summary and Description: Yes **Summary:** The text details the concept of Zero Standing Privileges (ZSP) and its implementation as a crucial security mechanism for enhancing privileged access management (PAM). It posits ZSP as a more effective alternative to traditional Just-In-Time (JIT)…