Support team
Darkbit Blog

GCP Predefined IAM Role Permission Tracker

During one of our Google Cloud Platform (GCP) security assessments, we noticed that one of the Predefined IAM Roles had more permissions than before. After a bit, we noticed the GCP IAM Permissions Change Log explained which permissions were added. So, we decided to automatically track those changes, and the results have been enlightening.

A Ruby Performance Experiment for the Modern Cloud - AWS Recon

Is Ruby too slow to be taken seriously in modern, fast-paced, enterprise-scale cloud environments? According to Twitter, StackOverflow, and all the cool kids except this one, the answer seems to be “Yes!” Surely the right tool these days would be Node, Go, Rust, or even Python. Nothing fast is built with Ruby, right? Let’s find out…

aws inventory security eks ecs recon cli asset discovery

Prioritizing Cloud Risk Requires Context to be Effective

Cloud security configuration scanning tools and similar approaches offer great insight at the technical level and are a foundational component of a risk assessment strategy. Prioritizing risk mitigation based on that low level output alone misses something critical (pun intended): organizational context.

risk assessment nist csf cybersecurity framework cloud k8s kubernetes

MKIT - Managed Kubernetes Inspection Tool

Introducing MKIT, a free, open-source tool that provides security-conscious Kubernetes cluster administrators a quick and easy way to assess several common misconfigurations of the cluster itself and the workloads running inside.

kubernetes aks eks gke k8s

Advanced Persistence Threats - The Future of Kubernetes Attacks

“What would happen if an attacker understood Kubernetes better than your operations team?” That was the core question that Ian Coldwater and I posed to each other, and it became clear that the research in this area is underexplored. Last week at RSA Conference 2020 we had the honor of presenting our thoughts on what attackers would do, how they might do it, and how they might try to avoid detection. We look forward to presenting an even more advanced version of this talk at KubeCon EU 2020.

kubernetes apt rsa k8s

Simple DLP for AWS S3

When discussing the risk S3 buckets pose to organizations, the majority of the discussion is around public buckets and inadvertently exposing access. While this is certainly a common threat vector, it can be addressed in a number of policy-driven ways. Blocking the ability to accidentally expose buckets at the organization or account level is much more practical now, and probably a more scalable and sound approach than trying to implement a reactive solution.

aws s3 dlp security

NSA Guidance on Mitigating Cloud Vulnerabilities

The National Security Agency (NSA) today published guidance aimed at “organizational leadership and technical staff”, outlining practical ways organizations can mitigate the most common cloud vulnerabilities. In this post, we’ll highlight the key elements of the NSA’s guidance for convenient reference. The full report is linked below.

cloud security nsa

Understanding Amazon S3 Block Public Access

Despite advances in Amazon Web Services (AWS) controls around S3 (Amazon Simple Storage Service), we continue to see data leaks and breaches centered around data stored on S3. In November 2018, Amazon released the Block Public Access feature to make it easier to secure access to S3. Newly created S3 buckets have always been private by default, but there is still confusion around the different ways data in an S3 bucket can become public.

aws s3 cloud