OAuth is the widely used standard for access delegation, enabling many of the "Sign in with X" buttons and "Connect your Calendar" features of modern Internet software. OAuth 2.0 is the most common and recent version of this specification, which defines four grant types (as well as various extensions), specifically suited for different use cases. … Continue reading An offensive guide to the Authorization Code grant
Author: Rami McCarthy
Rami McCarthy is a Security Consultant with NCC Group, joining with the acquisition of VSR in 2016. He's spent the past three years performing security assessments of all kinds, from SaaS products to cloud IoT platforms. In addition to client work, Rami created `sadcloud` - a tool for standing up (and tearing down!) purposefully insecure cloud infrastructure, and has authored a variety of research. Rami has a BS in CS from Northeastern University, with a concentration in cyber operations and is currently pursuing an MS from Brandeis University.
Tool Release – ScoutSuite 5.9.0
We're proud to announce the release of a new version of our open-source, multi-cloud auditing tool ScoutSuite (on Github)! Since the release of 5.8.0 back in late March, we've had over 300 commits from 8 different contributors, and closed 30 PRs. Notable improvements and features include: AWS Added 4 new ELB and ELBv2 findingsAdded support … Continue reading Tool Release – ScoutSuite 5.9.0
The Extended AWS Security Ramp-Up Guide
On November 25th, AWS released the Ramp-Up Learning Guide for AWS Cloud Security, Governance, and Compliance. The Security Ramp-Up is a curated list of educational AWS resources. The goal is "to teach in-demand cloud skills and real-world knowledge that you can rely on to keep up with cloud security, governance, and compliance developments and grow … Continue reading The Extended AWS Security Ramp-Up Guide