AWS achieves HDS certification in two additional Regions

Post Syndicated from Janice Leung original https://aws.amazon.com/blogs/security/aws-achieves-hds-certification-in-two-additional-regions-2/

Amazon Web Services (AWS) is pleased to announce that two additional AWS Regions—Middle East (UAE) and Europe (Zurich)—have been granted the Health Data Hosting (Hébergeur de Données de Santé, HDS) certification, increasing the scope to 20 global AWS Regions.

The Agence Française de la Santé Numérique (ASIP Santé), the French governmental agency for health, introduced the HDS certification to strengthen the security and protection of personal health data. By achieving this certification, AWS demonstrates our commitment to adhere to the heightened expectations for cloud service providers.

The following 20 Regions are in scope for this certification:

  • US East (Ohio)
  • US East (Northern Virginia)
  • US West (Northern California)
  • US West (Oregon)
  • Asia Pacific (Jakarta)
  • Asia Pacific (Seoul)
  • Asia Pacific (Mumbai)
  • Asia Pacific (Singapore)
  • Asia Pacific (Sydney)
  • Asia Pacific (Tokyo)
  • Canada (Central)
  • Europe (Frankfurt)
  • Europe (Ireland)
  • Europe (London)
  • Europe (Milan)
  • Europe (Paris)
  • Europe (Stockholm)
  • Europe (Zurich)
  • Middle East (UAE)
  • South America (São Paulo)

The HDS certification demonstrates that AWS provides a framework for technical and governance measures that secure and protect personal health data, governed by French law. Our customers who handle personal health data can continue to manage their workloads in HDS-certified Regions with confidence.

Independent third-party auditors evaluated and certified AWS on September 8, 2023. The Certificate of Compliance demonstrating AWS compliance status is available on the Agence du Numérique en Santé (ANS) website and AWS Artifact. AWS Artifact is a self-service portal for on-demand access to AWS compliance reports. Sign in to AWS Artifact in the AWS Management Console, or learn more at Getting Started with AWS Artifact.

For up-to-date information, including when additional Regions are added, see the AWS Compliance Programs page and choose HDS.

AWS strives to continuously meet your architectural and regulatory needs. If you have questions or feedback about HDS compliance, reach out to your AWS account team.

To learn more about our compliance and security programs, see AWS Compliance Programs. As always, we value your feedback and questions; reach out to the AWS Compliance team through the Contact Us page.

If you have feedback about this post, submit comments in the Comments section below.

Want more AWS Security news? Follow us on Twitter.

Author

Janice Leung

Janice is a Security Assurance Audit Program Manager at AWS, based in New York. She leads security audits across Europe and previously worked in security assurance and technology risk management in the financial industry for 11 years.

Building companies means building careers: why I joined Cloudflare as Chief People Officer

Post Syndicated from Michele Yetman original http://blog.cloudflare.com/why-i-joined-cloudflare-as-chief-people-officer/

Building companies means building careers: why I joined Cloudflare as Chief People Officer

Building companies means building careers: why I joined Cloudflare as Chief People Officer

One piece of advice I received early in my career was to get into a transformative industry. Those words have followed me ever since, and it’s a goal I’ve encouraged many others to pursue.

For me, it meant first launching into biotechnology where I learned my passion for working with deeply technical and disruptive businesses doing things that hadn’t been done before.

I later joined Amazon at a time when it was best known as a retailer instead of a technology company as it is today. While there, I led HR for some of their most technical businesses from eCommerce to AWS. As all these businesses scaled over the next decade, I became increasingly focused, and then finally fully dedicated to, leading HR for AWS. During that time, I had the opportunity to serve as a thought partner to the AWS CEO and leadership team as the organization grew from 400 employees to 30,000.

It was at this point in my career that I realized my passion for scaling a company with practices that reinforce the mission and building programs with intention to nurture the culture. To have any impact, all this work must be in support of promoting a diverse and inclusive workplace that values individual and group differences to ensure all employees, across a diversity of backgrounds and perspectives, feel valued, welcome, and integrated.

Later, I took all those learnings to Tableau as Chief Human Resource Officer (CHRO) before it was acquired by Salesforce. Like AWS, Tableau was ready to begin its next phase of growth and I designed and implemented the next generation talent strategy that supported the long-term growth plans for the business.

Today, as a two-time Chief People Officer and with experience and passion for scaling large global companies, building is in my DNA. That’s why Cloudflare’s bold mission to “help to build a better Internet” excites me. I am a builder at my core, and am humbled for the opportunity to help build again and to be selected to join the team for this next phase of the Cloudflare journey.

There are three things that stood out to me and made this next step an easy one:

The technology

Cloudflare caught my attention as a next generation disruptor in the tech industry by offering security, availability, and scalability of applications with no trade off with speed. The advancement of generative AI and Cloudflare's partnership with many of these businesses as customers put it front and center at a transformative time in the tech space.

The values

It was evident with each interview how the company deeply values both its customers and its people. The transparency and keen attention on scaling what is already a very special place to work was evident with each conversation. That really resonated with me. I always view my work through the lens of how it impacts people, leaders, and customers. For me, putting both customers and people at the center of everything we do on the Cloudflare’s growing People team is paramount as we create the people strategy that supports achieving the company’s high-growth business objectives.

The culture

Too often, company culture is defined by, and confined to, employee handbooks and posters on the wall. In rarer cases, it's something that is both innate and carefully nurtured by leaders who demonstrate their values through their actions. That’s what I’ve found at Cloudflare. The transparency, trust, and curiosity of this organization is energizing. The people I’ve had the opportunity to engage with have been warm, humble, and bright.

As I launch in my new position here at Cloudflare, my priority will be to first learn as much as I can about the people-first culture and ensure the work we do within the People team is aligned. I’m excited to bring my own curiosity and passion for disruptive and transformative companies to a new team to help Cloudflare scale and flourish, and help build amazing careers for all of our people.

Restore Like Never Before: Introducing Backblaze Computer Backup v9.0

Post Syndicated from Yev original https://www.backblaze.com/blog/restore-like-never-before-introducing-backblaze-computer-backup-v9-0/

A decorative image displaying the title Backblaze Computer Backup and v9.0.

Get ready. The release of Backblaze Computer Backup 9.0 is rolling out now through the end of September.

Backblaze Computer Backup 9.0 is available today in early access, and restoring your files is about to get a whole lot easier.

What’s New in Backblaze Computer Backup 9.0?

Whether you’re a longtime user or just getting started with Backblaze, version 9.0 provides you with an unparalleled backup and restore solution. With our latest release, you get our most requested feature: a dedicated restore app for both macOS and Windows clients that makes the process of restoring your data even more intuitive, seamless, and streamlined than before. The new version also comes with essential bug fixes and performance improvements to keep your back up experience ahead of the curve for both security and speed. 

Backblaze Restore App: macOS and Windows Highlights

Whether you’re using our macOS or Windows clients, you can now recover your important data with even more ease.

The restore app sign in screen.
Your library of files in the restore app.
What it looks like when you prepare a restore.
A handy Restore Log so you can track your progress.
Check out some of the things you can expect to see from the restore app.

Here’s a peek into some of the new features we have in store with our new Restore Client App: 

  • Simplified restore initiation process. When you’ve lost important files, the last thing you want is a demanding process sitting between you and restoring your data. With the restore app, you authenticate your Backblaze account and initiate the restore directly from your desktop. Once authenticated, you can browse your file tree and kick off the restore process immediately.
  • No limits for restore size. There are no limits to restore sizes inside of the restore app. Conserving disk space is important and you shouldn’t have to worry about downloading a .zip and having enough additional space to unzip it as well. 

If you’re interested in a comprehensive tutorial on how to use the new restore app, we’re here to guide you. Let us walk you through the process.

We’re excited that our version 9.0 release compliments your already robust methods of accessing your data. To access your backup from anywhere, you can log in to www.backblaze.com to initiate a restore and use our iOS and Android apps to access your files on the go. 

Backblaze v9.0 Is Available in Early Access Today: September 13, 2023

We will be taking feedback and slowly auto-updating all users in the coming weeks, but if you can’t wait and want to download the early access release now on your Mac or PC:

  1. Go to: https://www.backblaze.com/status/backup-beta
  2. Select your operating system and download the v9.0 app.
  3. Install the early access release on your computer.

Please note, since this is in early access you might hit some bugs. Please reach out to our Support Team if you have any questions or if you want to give feedback—we always like to know how things are going.

The post Restore Like Never Before: Introducing Backblaze Computer Backup v9.0 appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

Забавяне на рестарта на „Тоест“. И един апел за помощ

Post Syndicated from Тоест original https://www.toest.bg/zavavyane-na-restarta-apel-za-pomosht/

Забавяне на рестарта на „Тоест“. И един апел за помощ

През тези 5 години и половина „Тоест“ винаги е съществувал с крайно икономичен бюджет и къс хоризонт. Този хоризонт сега се сви до месец. Подновяваме дейност на 1 октомври – с неясно бъдеще и спешна нужда от подкрепа.

Какво стана?

Финансовото положение на „Тоест“ никога не е било розово и през годините сме оцелявали на инат. Безкрайно признателни сме за всеки лев подкрепа от читателите, но доходите от краудфъндинг, освен крайно недостатъчни, са и несигурни – във всеки момент нашите дарители могат да спират и подновяват месечните си микродарения. Затова през тези години спестявахме каквото можехме и успяхме да съберем малък резерв „за черни дни“ (разделен на петте години, този резерв се равняваше на около 170 лв. месечно).

Същевременно обаче съвместяването на няколко роли от един и същ човек и огромното количество доброволен труд водеха до изтощение и демотивация, а авторските хонорари, поначало скромни, стояха на едно и също ниво през всичките тези пет години.

Беше наложително да направим генерална промяна.

В началото на 2023 г. преструктурирахме дейността и разпределихме по-добре ролите, за да бъдем по-ефективни. Привлякохме двама отговорни редактори, които да се грижат за съдържанието. Междувременно коригирахме хонорарите, така че да достигнат поне 50% от нивата при другите медии. Използвахме спестения резерв, за да си спечелим време и да се опитаме да отскочим.

Посрещнахме петия си рожден ден с изцяло нов сайт, разширен екип от редактори и автори, както и с нови рубрики, които бързо намериха верни читатели. Създадохме дарителски пакети със специални подаръци и бонуси за читателите, а малко преди началото на лятото представихме шоколада с кауза „Гайо & Тоест“. Междувременно кандидатствахме (самостоятелно и в партньорство с други организации) по шест програми за финансиране на културни и медийни проекти. С други думи,

не спираме да търсим всякакви допълнителни източници на финансиране.

За съжаление, и по шестте програми за финансиране не постигнахме успех. Не сме се отказали и от по-нататъшни кандидатствания, но е важно да отбележим, че повечето от програмите финансират целево конкретно разписан проект (за тема, рубрика, поредица от материали). А смисълът и ползата от една независима медия е да обхваща по-широк спектър от важните за обществото проблеми, не да се фокусира върху конкретната тема, за която е получила финансиране.

Затова преди всичко трябва да подсигурим цялостното съществуване на медията.

Колко струва „Тоест“ на месец?

Създаването на всяка отделна статия не се свежда само до написването ѝ от автора. Нужни са внимателна проверка на фактите и грижлива редакторска работа за оформянето на текста в качествен, полезен и езиково издържан журналистически продукт.

Извън създаването на съдържание има и редица административни дейности – техническа поддръжка на сайта, управление на платежните системи, водене на документация и сметки, заплащане за външни услуги, като счетоводство, банково обслужване, годишни такси за различни платформи, хостинг, домейн. Тоест разходи, които си текат, без значение дали създаваме съдържание, или не.

Ако трябва да осигурим достойно и съпоставимо с другите медии заплащане на труда на екипа и да начислим всички реални разходи, ще са нужни минимум 10 000 лева на месец. Докато достигнем тази сума, целият екип на „Тоест“ е решен да продължи работата си при настоящите нива на заплащане. Защото всички вярваме в смисъла на този проект, в качеството, което предлагаме, в нуждата от това свободно и независимо пространство за спокоен и качествен обществен дебат.

Защо просто не пуснем реклами?

Рекламите (особено онлайн и особено в България) са твърде евтини и за да има смисъл от тях, трябва да са много. Рекламните банери да заемат голяма част от сайта. Освен всичко те не се появяват сами. Трябва някой да ги продава и обслужва – да търси рекламодатели, да уговаря условия, да осигурява техническото изпълнение. Тези разходи изяждат съществен дял от приходите. За една малка медия това обезсмисля цялото упражнение. Особено за медия като „Тоест“ – с малко, но дълги аналитични текстове, която категорично отказва да залага на бомбастични заглавия, за да печели кликове на всяка цена и да си осигури мащабен трафик.

И най-важната причина – независимостта. Ако медията е обвързана с рекламодатели, кръгът от теми и проблеми, които намират място в нейната платформа, се стеснява. Променя се и начинът, по който екипът на медията подхожда към работата си, защото цензурата поражда и автоцензура.

Пример: Материалът на „Тоест“ за неморалните практики А1 не беше отразен и развит от други медии, нито дори разпространен от изданията, които обичайно препечатват нашите статии. Защо? Защото А1 е огромен рекламодател. И дори някоя медия или медийна група да няма обвързаност с А1 (или с рекламодател от подобен мащаб), то тя се надява да има такава в бъдеще. В случая поговорката „Който плаща, той поръчва музиката“ важи с пълна сила. И тъкмо тази сила смазва независимостта на една медия.

Защо не затворим съдържанието и не се издържаме с абонаменти за четене?

Заключването на съдържанието и затварянето му само за определен кръг от хора, които могат да си платят за него, е дискриминационно и влиза в разрез с основния принцип на журналистиката – да информира обществото, цялото общество. Свеждането на една медия до затворено пространство за избрани хора (без значение от размера на абонамента) подменя нейните функции и създава финансова бариера, която трябва да преминеш, за да си добре информиран. Създаването на „информационни касти“ е опасно и погрешно, особено във времена като настоящите, в които свободният достъп до достоверно, проверено и качествено поднесено журналистическо съдържание е от ключова важност за развитието на обществата.

Какво следва?

За поддържането на обичайното качество и количество на материалите в „Тоест“ при настоящите хонорари са нужни 5500 лева на месец. Месечните абонаментни дарения от читатели в момента са около 3000 лева.

На първо време трябва да запълним тази дупка от 2500 лева на месец, за да запазим екипа и да продължим с досегашния ритъм и качество. И тук много ще разчитаме на вас, скъпи читатели и настоящи дарители на „Тоест“. Разкажете на още някого за нас – защо ни харесвате и защо за вас е важно да продължим. Със свои думи и аргументи. Споделете, че ни подкрепяте, и го помолете да направи същото – чрез някой от нашите дарителски пакети, в които сме включили много сладки (и в буквалния смисъл) подаръци.

Ако всеки от вас убеди по само още един човек да ни подкрепи, ще достигнем първата критична сума.

Дарителски пакети

Междувременно ние продължаваме да търсим и други източници на финансиране. Следващата стъпка е да се обърнем към бизнеса за подкрепа.

Знаем, че съществуват много успешни български бизнеси, които работят на световно ниво и са конкурентни, дори водещи в областта си на световния пазар. Които са независими от обществените поръчки и благоразположението на властта. Които ясно осъзнават, че добрата среда за предприемачество е пряко свързана с добрата обществена среда, а за изграждането ѝ е критично важно да има свободни медии. И не на последно място: бизнеси, които биха подкрепили качествената журналистика не срещу стандартното „медийно отразяване“ – с публикуване на готови прессъобщения и спонсорирани статии.

В „Тоест“ можем да ви предложим много повече от това.

Ние ще подходим индивидуално и с професионализъм към вашата история, спазвайки всички журналистически стандарти, така че разказът за успехите ви и за продуктите, които създавате, да е полезен и интересен както на нашите читатели, така и на потенциалните ви клиенти и служители.

Свържете се с нас!

Медиите няма как да бъдат бизнес начинание, което да носи печалба. Те по замисъл имат други цели – да информират, да задават трудните въпроси, да се ангажират с важните за обществото проблеми, да бъдат критични към властта.

Не само в България медиите изпитват финансови затруднения. В статията на „Гардиън“ от 16 май т.г. може да прочетете за фалита на Vice; за гибелта на BuzzFeed и съкращенията в големи световни медии; за бизнес моделите, базирани на реклама, които вече не работят, защото твърде нищожна част остава за самите медии; за принудата медийните проекти да се занимават с какво ли не извън журналистиката, само и само да оцелеят.

Съществуването на независими медии е от огромна важност за прогреса на едно общество и е пряко свързано с икономическото развитие на страната. Потребяването на качествено журналистическо съдържание (важни теми, проверени източници, задълбочена разработка, хубав език, грамотно писане) формира критично мислене и създава проактивни и социално ангажирани хора.

Това са хората, които искаме да наемем на работа, с които искаме да правим бизнес, с които предпочитаме да се разминаваме като водачи на пътното платно. С които можем да строим някакво общо бъдеще.

Security updates for Wednesday

Post Syndicated from corbet original https://lwn.net/Articles/944354/

Security updates have been issued by Debian (e2guardian), Fedora (libeconf), Red Hat (dmidecode, kernel, kernel-rt, keylime, kpatch-patch, libcap, librsvg2, linux-firmware, and qemu-kvm), Slackware (mozilla), SUSE (chromium and shadow), and Ubuntu (cups, dotnet6, dotnet7, file, flac, and ruby-redcloth).

Zero-Click Exploit in iPhones

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2023/09/zero-click-exploit-in-iphones.html

Make sure you update your iPhones:

Citizen Lab says two zero-days fixed by Apple today in emergency security updates were actively abused as part of a zero-click exploit chain (dubbed BLASTPASS) to deploy NSO Group’s Pegasus commercial spyware onto fully patched iPhones.

The two bugs, tracked as CVE-2023-41064 and CVE-2023-41061, allowed the attackers to infect a fully-patched iPhone running iOS 16.6 and belonging to a Washington DC-based civil society organization via PassKit attachments containing malicious images.

“We refer to the exploit chain as BLASTPASS. The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim,” Citizen Lab said.

“The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim.”

Simplifying Digital Transformation with Marianna Portela

Post Syndicated from Michael Kammer original https://blog.zabbix.com/simplifying-digital-transformation-with-marianna-portela/26609/

To help everyone in our community get up to speed with Zabbix Summit speakers and their topics, we’re continuing our series of interviews and sitting down for a chat with Marianna Portela of Brazilian mass media conglomerate Globo. Read on to get a preview of her Summit speech topic and see how she uses Zabbix to bring massive live events to millions of users around the globe.

Please tell us a bit about yourself and your work.

I’m a tech lead at Globo, the largest media group in Latin America. It includes over-the-air broadcasting, television and film production, a pay television subscription service, streaming media, publishing, and online services.

How long have you been using Zabbix? What kind of daily Zabbix tasks are you involved in at your company?

I have been working at Globo for 15 years. I’ve been involved in monitoring for 11 of those years, and I’ve been using Zabbix for 10. I help monitor the applications that generate data for live events, and I use Zabbix to generate metrics that support decision-making related to better content delivery quality.

Can you name a few of the specific challenges that Zabbix has helped you solve?

Zabbix allows us to empower our users and supports our entire digital transformation – including many things related to Globoplay streaming. It also helps us monitor live event infrastructure, like the Olympics and World Cup. Previously, when there were technical issues during live events, we would try to figure out what happened after the fact, but no longer – Zabbix gives us a proactive analysis of potential occurrences within live production.

Can you give us a sneak peek at what we can expect to hear during your Zabbix Summit speech?

I’m planning to talk about how we use Zabbix to help ensure the quality monitoring of live production, which is essentially the production and the part of Globo that deals with any type of live event and generates data for things like games, for example. I’ll introduce how we started with actual infrastructure monitoring and how this digital transformation at Globo began, specifically how we managed to enter new areas like content generation, especially live content. Then I’ll also discuss some specifics of how we monitor live event infrastructure.

The post Simplifying Digital Transformation with Marianna Portela appeared first on Zabbix Blog.

Patch Tuesday – September 2023

Post Syndicated from Adam Barnett original https://blog.rapid7.com/2023/09/12/patch-tuesday-september-2023/

Patch Tuesday - September 2023

Microsoft is addressing 65 vulnerabilities this September Patch Tuesday, including two zero-day vulnerabilities, as well as four critical remote code execution (RCE) vulnerabilities, and six republished third-party vulnerabilities.

Word: zero-day NTLM hash disclosure

Microsoft Word receives a patch for CVE-2023-36761, which is marked as exploited in the wild as well as publicly disclosed; successful exploitation results in disclosure of NTLM hashes, which could provide an attacker with the means to “Pass the Hash” and authenticate remotely without any need to brute force the hash. Microsoft is clearly concerned about the potential impact of CVE-2023-36761, since they are providing patches not only for current versions of Word, but also for Word 2013, which reached its Extended End Date back in April 2023. In March, Microsoft patched CVE-2023-23397, a vulnerability in Outlook which also led to NTLM hash leaks, and which received significant attention at the time.

Streaming Service Proxy: zero-day elevation to SYSTEM

The second second zero-day vulnerability patched this month is CVE-2023-36802, an elevation of privilege vulnerability in Microsoft Streaming Service Proxy, which could grant SYSTEM privileges via exploitation of a kernel driver. Microsoft has detected in-the-wild exploitation, but is not aware of publicly available exploit code. This is a debut Patch Tuesday appearance for Microsoft Streaming Service, but with several researchers from across the globe acknowledged on the advisory, it’s unlikely to be the last. Today’s confirmation of in-the-wild exploitation prior to publication all but guarantees that this will remain an area of interest.

Internet Connection Sharing: same-network critical RCE

CVE-2023-38148 describes a critical remote code execution (RCE) in the Windows Internet Connection Sharing (ICS) functionality. Although the advisory is light on detail, it’s likely that successful exploitation would lead to arbitrary code execution on the ICS host at SYSTEM level. The silver lining is that the attack cannot be carried out from another network, so attackers must first establish an adjacent foothold.

Visual Studio & .NET: critical RCE via malicious package file

This month’s three other critical RCE vulnerabilities have quite a lot in common: CVE-2023-36792, CVE-2023-36793, and CVE-2023-36796 all rely on the user opening a malicious package file, and are thus classed as arbitrary code execution rather than no-interaction RCE. In each case, patches are available for a long list of Visual Studio and .NET installations. Organizations with large developer headcount are likely to be disproportionately at risk.

Exchange (as usual):  RCE

Microsoft is patching five vulnerabilities in Exchange this month. Although Microsoft doesn’t rate any of these higher than “Important” under their proprietary severity rating system, three of the five are RCE vulnerabilities with CVSSv3 base score of 8.0. CVE-2023-36744 CVE-2023-36745, and CVE-2023-36756 would surely receive higher severity if not for several mitigating factors. Successful exploitation requires that the attacker must be present on the same LAN as the Exchange server, and must already possess valid credentials for an Exchange user. Additionally, Microsoft notes that the August 2023 patches already protect against these newly published vulnerabilities, further underscoring the value of timely patching.

SharePoint: elevation to admin

SharePoint receives a patch for CVE-2023-36764, which allows an attacker to achieve administrator privileges via a specially-crafted ASP.NET page. As is often the case with SharePoint vulnerabilities, a level of access is already required, but Site Member privileges are typically widely granted.

Azure DevOps Server: elevation of privilege & RCE

Azure DevOps Server receives two fixes this month. While CVE-2023-38155 requires that an attacker carry out significant recon and preparation of the environment, successful exploitation would lead to administrator privileges. Potentially of greater concern is CVE-2023-33136, which allows an attacker with Queue Build permissions to abuse an overridable input variable to achieve RCE. While most DevOps Server installations are hopefully managed by people both willing and able to apply prompt upgrades, CI/CD environments are prime targets for supply chain attacks.

They do it with Mira

A vulnerability in the Windows implementation of wireless display standard Miracast allows for an unauthenticated user to project to a vulnerable system. Although CVE-2023-38147 requires that an attacker be in close physical proximity to the target, consider that wireless display technology is often used in high-traffic environments such as conventions, which could allow an opportunistic attacker to inflict reputational damage. While exploitation requires that the target asset is configured to allow “Projecting to this PC” and marked as “Available Everywhere” – and Microsoft points out that this is not the default configuration – most administrators will know from long experience that many users will simply select whichever options cause them the least friction.

Summary Charts

Patch Tuesday - September 2023
A relatively light month, albeit with some seldom-seen components like Streaming Service and Internet Connection Sharing.
Patch Tuesday - September 2023
Still holding the #1 spot: Remote Code Excution.
Patch Tuesday - September 2023
The typical cluster around 8.0.
Patch Tuesday - September 2023
3D Builder: not as innocent as it looks.

Summary Table

Apps vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36760 3D Viewer Remote Code Execution Vulnerability No No 7.8
CVE-2023-36740 3D Viewer Remote Code Execution Vulnerability No No 7.8
CVE-2023-36739 3D Viewer Remote Code Execution Vulnerability No No 7.8
CVE-2023-36773 3D Builder Remote Code Execution Vulnerability No No 7.8
CVE-2023-36772 3D Builder Remote Code Execution Vulnerability No No 7.8
CVE-2023-36771 3D Builder Remote Code Execution Vulnerability No No 7.8
CVE-2023-36770 3D Builder Remote Code Execution Vulnerability No No 7.8
CVE-2022-41303 AutoDesk: CVE-2022-41303 use-after-free vulnerability in Autodesk® FBX® SDK 2020 or prior No No N/A

Azure vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-29332 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability No No 7.5
CVE-2023-38156 Azure HDInsight Apache Ambari Elevation of Privilege Vulnerability No No 7.2
CVE-2023-36736 Microsoft Identity Linux Broker Remote Code Execution Vulnerability No No 4.4

Azure Developer Tools vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-33136 Azure DevOps Server Remote Code Execution Vulnerability No No 8.8
CVE-2023-38155 Azure DevOps Server Remote Code Execution Vulnerability No No 7

Browser vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-4863 Chromium: CVE-2023-4863 Heap buffer overflow in WebP No No N/A
CVE-2023-4764 Chromium: CVE-2023-4764 Incorrect security UI in BFCache No No N/A
CVE-2023-4763 Chromium: CVE-2023-4763 Use after free in Networks No No N/A
CVE-2023-4762 Chromium: CVE-2023-4762 Type Confusion in V8 No No N/A
CVE-2023-4761 Chromium: CVE-2023-4761 Out of bounds memory access in FedCM No No N/A

Developer Tools vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36796 Visual Studio Remote Code Execution Vulnerability No No 7.8
CVE-2023-36793 Visual Studio Remote Code Execution Vulnerability No No 7.8
CVE-2023-36792 Visual Studio Remote Code Execution Vulnerability No No 7.8
CVE-2023-36794 Visual Studio Remote Code Execution Vulnerability No No 7.8
CVE-2023-36758 Visual Studio Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36742 Visual Studio Code Remote Code Execution Vulnerability No No 7.8
CVE-2023-36788 .NET Framework Remote Code Execution Vulnerability No No 7.8
CVE-2023-36759 Visual Studio Elevation of Privilege Vulnerability No No 6.7
CVE-2023-36799 .NET Core and Visual Studio Denial of Service Vulnerability No No 6.5
CVE-2023-39956 Electron: CVE-2023-39956 -Visual Studio Code Remote Code Execution Vulnerability No No N/A

Exchange Server vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36757 Microsoft Exchange Server Spoofing Vulnerability No No 8
CVE-2023-36756 Microsoft Exchange Server Remote Code Execution Vulnerability No No 8
CVE-2023-36745 Microsoft Exchange Server Remote Code Execution Vulnerability No No 8
CVE-2023-36744 Microsoft Exchange Server Remote Code Execution Vulnerability No No 8
CVE-2023-36777 Microsoft Exchange Server Information Disclosure Vulnerability No No 5.7

Microsoft Dynamics vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36886 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability No No 7.6
CVE-2023-38164 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability No No 7.6
CVE-2023-36800 Dynamics Finance and Operations Cross-site Scripting Vulnerability No No 7.6

Microsoft Office vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36764 Microsoft SharePoint Server Elevation of Privilege Vulnerability No No 8.8
CVE-2023-36765 Microsoft Office Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36766 Microsoft Excel Information Disclosure Vulnerability No No 7.8
CVE-2023-36763 Microsoft Outlook Information Disclosure Vulnerability No No 7.5
CVE-2023-36762 Microsoft Word Remote Code Execution Vulnerability No No 7.3
CVE-2023-36761 Microsoft Word Information Disclosure Vulnerability Yes Yes 6.2
CVE-2023-41764 Microsoft Office Spoofing Vulnerability No No 5.5
CVE-2023-36767 Microsoft Office Security Feature Bypass Vulnerability No No 4.3

System Center vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-38163 Windows Defender Attack Surface Reduction Security Feature Bypass No No 7.8

Windows vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-38146 Windows Themes Remote Code Execution Vulnerability No No 8.8
CVE-2023-38147 Windows Miracast Wireless Display Remote Code Execution Vulnerability No No 8.8
CVE-2023-38148 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability No No 8.8
CVE-2023-38150 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-35355 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36802 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability Yes No 7.8
CVE-2023-38162 DHCP Server Service Denial of Service Vulnerability No No 7.5
CVE-2023-36805 Windows MSHTML Platform Security Feature Bypass Vulnerability No No 7
CVE-2023-38140 Windows Kernel Information Disclosure Vulnerability No No 5.5
CVE-2023-36803 Windows Kernel Information Disclosure Vulnerability No No 5.5

Windows ESU vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-38142 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38141 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38139 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38161 Windows GDI Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36804 Windows GDI Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38144 Windows Common Log File System Driver Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38143 Windows Common Log File System Driver Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38149 Windows TCP/IP Denial of Service Vulnerability No No 7.5
CVE-2023-38160 Windows TCP/IP Information Disclosure Vulnerability No No 5.5
CVE-2023-38152 DHCP Server Service Information Disclosure Vulnerability No No 5.3
CVE-2023-36801 DHCP Server Service Information Disclosure Vulnerability No No 5.3

A GCC -fstack-protector vulnerability on arm64

Post Syndicated from corbet original https://lwn.net/Articles/944307/

The GCC stack-protector feature detects stack-based buffer overruns by
putting a canary value on the stack and noticing if that value is changed.
It
turns out, though, that dynamically allocated local variables (such as
variable-length arrays and space obtained with alloca()) are
placed beyond the canary, so overflows of those variables will not be
detected. As a result, arm64 binaries built with vulnerable versions of
GCC are not as protected as they should be and need to be rebuilt.

Dynamic allocations are just as susceptible to overflows as other
locals. In fact, they’re arguably more susceptible because they’re
almost always arrays, whereas fixed locals are often integers,
pointers, or other types to which variable-length data is never
written. GCC’s own heuristics for when to use a stack guard reflect
this.

Kees Cook, meanwhile, has pointed out that
the kernel no longer uses variable-length arrays, so kernel builds should
not be affected by this vulnerability.

[$] Arduino: open source for microcontroller boards

Post Syndicated from jake original https://lwn.net/Articles/944038/

Arduino has emerged as one of the
prime success stories of the open-hardware movement. In recent years, the
company has shifted its focus toward Internet of Things (IoT)
applications. As part of this transformation, it has completely redesigned
its open-source integrated development environment (IDE), adding a more
professional feature set for its hobbyist target audience. If you have
experimented with Arduino in the past, but have lost track of its
progress, now might be a good time to give it another try.

Password-stealing Linux malware served for 3 years and no one noticed (Ars Technica)

Post Syndicated from jake original https://lwn.net/Articles/944306/

Ars Technica reports on a credential-stealing Trojan horse that would infect only some of those who installed the “Free Download Manager”. The article is based on a Kaspersky report that details the malicious payload offered up at that site from 2020 to 2022.

The site, freedownloadmanager[.]org, offered a benign version of a Linux offering known as the Free Download Manager. Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app. The version available on the malicious domain contained a script that downloaded two executable files to the /var/tmp/crond and /var/tmp/bs file paths. The script then used the cron job scheduler to cause the file at /var/tmp/crond to launch every 10 minutes. With that, devices that had installed the booby-trapped version of Free Download Manager were permanently backdoored.

Intel Xeon MAX 9480 Deep-Dive 64GB HBM2e Onboard Like a GPU or AI Accelerator

Post Syndicated from Patrick Kennedy original https://www.servethehome.com/intel-xeon-max-9480-deep-dive-intel-has-64gb-hbm2e-onboard-like-a-gpu-or-ai-accelerator/

We deep-dive into the Intel Xeon MAX 9480 and see several surprises when combining Xeon cores and HBM2e memory (like a GPU uses)

The post Intel Xeon MAX 9480 Deep-Dive 64GB HBM2e Onboard Like a GPU or AI Accelerator appeared first on ServeTheHome.

Access accounts with AWS Management Console Private Access

Post Syndicated from Suresh Samuel original https://aws.amazon.com/blogs/security/access-accounts-with-aws-management-console-private-access/

AWS Management Console Private Access is an advanced security feature to help you control access to the AWS Management Console. In this post, I will show you how this feature works, share current limitations, and provide AWS CloudFormation templates that you can use to automate the deployment. AWS Management Console Private Access is useful when you want to restrict users from signing in to unknown AWS accounts from within your network. With this feature, you can limit access to the console only to a specified set of known accounts when the traffic originates from within your network.

For enterprise customers, users typically access the console from devices that are connected to a corporate network, either directly or through a virtual private network (VPN). With network connectivity to the console, users can authenticate into an account with valid credentials, including third-party accounts and personal accounts. For enterprise customers with stringent network access controls, this feature provides a way to control which accounts can be accessed from on-premises networks.

How AWS Management Console Private Access works

AWS PrivateLink now supports the AWS Management Console, which means that you can create Virtual Private Cloud (VPC) endpoints in your VPC for the console. You can then use DNS forwarding to conditionally route users’ browser traffic to the VPC endpoints from on-premises and define endpoint policies that allow or deny access to specific accounts, organizations, or organizational units (OUs). To privately reach the endpoints, you must have a hybrid network connection between on-premises and AWS over AWS Direct Connect or AWS Site-to-Site VPN.

When you conditionally forward DNS queries for the zone aws.amazon.com from on-premises to an Amazon Route 53 Resolver inbound endpoint within the VPC, Route 53 will prefer the private hosted zone for aws.amazon.com to resolve the queries. The private hosted zone makes it simple to centrally manage records for the console in the AWS US East (N. Virginia) Region (us-east-1) as well as other Regions.

Configure a VPC endpoint for the console

To configure VPC endpoints for the console, you must complete the following steps:

  1. Create interface VPC endpoints in a VPC in the US East (N. Virginia) Region for the console and sign-in services. Repeat for other desired Regions. You must create VPC endpoints in the US East (N. Virginia) Region because the default DNS name for the console resolves to this Region. Specify the accounts, organizations, or OUs that should be allowed or denied in the endpoint policies. For instructions on how to create interface VPC endpoints, see Access an AWS service using an interface VPC endpoint.
  2. Create a Route 53 Resolver inbound endpoint in a VPC and note the IP addresses for the elastic network interfaces of the endpoint. Forward DNS queries for the console from on-premises to these IP addresses. For instructions on how to configure Route 53 Resolver, see Getting started with Route 53 Resolver.
  3. Create a Route 53 private hosted zone with records for the console and sign-in subdomains. For the full list of records needed, see DNS configuration for AWS Management Console and AWS Sign-In. Then associate the private hosted zone with the same VPC that has the Resolver inbound endpoint. For instructions on how to create a private hosted zone, see Creating a private hosted zone.
  4. Conditionally forward DNS queries for aws.amazon.com to the IP addresses of the Resolver inbound endpoint.

How to access Regions other than US East (N. Virginia)

To access the console for another supported Region using AWS Management Console Private Access, complete the following steps:

  1. Create the console and sign-in VPC endpoints in a VPC in that Region.
  2. Create resource records for <region>.console.aws.amazon.com and <region>.signin.aws.amazon.com in the private hosted zone, with values that target the respective VPC endpoints in that Region. Replace <region> with the region code (for example, us-west-2).

For increased resiliency, you can also configure a second Resolver inbound endpoint in a different Region other than the US East (N. Virginia) Region (us-east-1). On-premises DNS resolvers can use both endpoints for resilient DNS resolution to the private hosted zone.

Automate deployment of AWS Management Console Private Access

I created an AWS CloudFormation template that you can use to deploy the required resources in the US East (N. Virginia) Region (us-east-1). To get the template, go to console-endpoint-use1.yaml. The CloudFormation stack deploys the required VPC endpoints, Route 53 Resolver inbound endpoint, and private hosted zone with required records.

Note: The default endpoint policy allows all accounts. For sample policies with conditions to restrict access, see Allow AWS Management Console use for expected accounts and organizations only (trusted identities).

I also created a CloudFormation template that you can use to deploy the required resources in other Regions where private access to the console is required. To get the template, go to console-endpoint-non-use1.yaml.

Cost considerations

When you configure AWS Management Console Private Access, you will incur charges. You can use the following information to estimate these charges:

  • PrivateLink pricing is based on the number of hours that the VPC endpoints remain provisioned. In the US East (N. Virginia) Region, this is $0.01 per VPC endpoint per Availability Zone ($/hour).
  • Data processing charges per gigabyte (GB) of data processed through the VPC endpoints is $0.01 in the US East (N. Virginia) Region.
  • The Route 53 Resolver inbound endpoint is charged per IP (elastic network interface) per hour. In the US East (N. Virginia) Region, this is $0.125 per IP address per hour. See Route 53 pricing.
  • DNS queries to the inbound endpoint are charged at $0.40 per million queries.
  • The Route 53 hosted zone is charged at $0.50 per hosted zone per month. To allow testing, AWS won’t charge you for a hosted zone that you delete within 12 hours of creation.

Based on this pricing model, the cost of configuring AWS Management Console Private Access in the US East (N. Virginia) Region in two Availability Zones is approximately $212.20 per month for the deployed resources. DNS queries and data processing charges are additional based on actual usage. You can also apply this pricing model to help estimate the cost to configure in additional supported Regions. Route 53 is a global service, so you only have to create the private hosted zone once along with the resources in the US East (N. Virginia) Region.

Limitations and considerations

Before you get started with AWS Management Console Private Access, make sure to review the following limitations and considerations:

  • For a list of supported Regions and services, see Supported AWS Regions, service consoles, and features.
  • You can use this feature to restrict access to specific accounts from customer networks by forwarding DNS queries to the VPC endpoints. This feature doesn’t prevent users from accessing the console directly from the internet by using the console’s public endpoints from devices that aren’t on the corporate network.
  • The following subdomains aren’t currently supported by this feature and won’t be accessible through private access:
    • docs.aws.amazon.com
    • health.aws.amazon.com
    • status.aws.amazon.com
  • After a user completes authentication and accesses the console with private access, when they navigate to an individual service console, for example Amazon Elastic Compute Cloud (Amazon EC2), they must have network connectivity to the service’s API endpoint, such as ec2.amazonaws.com. This is needed for the console to make API calls such as ec2:DescribeInstances to display resource details in the service console.

Conclusion

In this blog post, I outlined how you can configure the console through AWS Management Console Private Access to restrict access to AWS accounts from on-premises, how the feature works, and how to configure it for multiple Regions. I also provided CloudFormation templates that you can use to automate the configuration of this feature. Finally, I shared information on costs and some limitations that you should consider before you configure private access to the console.

For more information about how to set up and test AWS Management Console Private Access and reference architectures, see Try AWS Management Console Private Access. For the latest CloudFormation templates, see the aws-management-console-private-access-automation GitHub repository.

If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, start a new thread at re:Post.

Want more AWS Security news? Follow us on Twitter.

Suresh Samuel

Suresh Samuel

Suresh is a Senior Technical Account Manager at AWS. He helps customers in the financial services industry with their operations on AWS. When not working, he can be found photographing birds in Texas or hanging out with his kids.

Understanding DDoS Simulation Testing in AWS

Post Syndicated from Harith Gaddamanugu original https://aws.amazon.com/blogs/security/understanding-ddos-simulation-testing-at-aws/

Distributed denial of service (DDoS) events occur when a threat actor sends traffic floods from multiple sources to disrupt the availability of a targeted application. DDoS simulation testing uses a controlled DDoS event to allow the owner of an application to assess the application’s resilience and practice event response. DDoS simulation testing is permitted on Amazon Web Services (AWS), subject to Testing policy terms and conditions. In this blog post, we help you understand when it’s appropriate to perform a DDoS simulation test on an application running on AWS, and what options you have for running the test.

DDoS protection at AWS

Security is the top priority at AWS. AWS services include basic DDoS protection as a standard feature to help protect customers from the most common and frequently occurring infrastructure (layer 3 and 4) DDoS events, such as SYN/UDP floods, reflection attacks, and others. While this protection is designed to protect the availability of AWS infrastructure, your application might require more nuanced protections that consider your traffic patterns and integrate with your internal reporting and incident response processes. If you need more nuanced protection, then you should consider subscribing to AWS Shield Advanced in addition to the native resiliency offered by the AWS services you use.

AWS Shield Advanced is a managed service that helps you protect your application against external threats, like DDoS events, volumetric bots, and vulnerability exploitation attempts. When you subscribe to Shield Advanced and add protection to your resources, Shield Advanced provides expanded DDoS event protection for those resources. With advanced protections enabled on your resources, you get tailored detection based on the traffic patterns of your application, assistance with protecting against Layer 7 DDoS events, access to 24×7 specialized support from the Shield Response Team (SRT), access to centralized management of security policies through AWS Firewall Manager, and cost protections to help safeguard against scaling charges resulting from DDoS-related usage spikes. You can also configure AWS WAF (a web application firewall) to integrate with Shield Advanced to create custom layer 7 firewall rules and enable automatic application layer DDoS mitigation.

Acceptable DDoS simulation use cases on AWS

AWS is constantly learning and innovating by delivering new DDoS protection capabilities, which are explained in the DDoS Best Practices whitepaper. This whitepaper provides an overview of DDoS events and the choices that you can make when building on AWS to help you architect your application to absorb or mitigate volumetric events. If your application is architected according to our best practices, then a DDoS simulation test might not be necessary, because these architectures have been through rigorous internal AWS testing and verified as best practices for customers to use.

Using DDoS simulations to explore the limits of AWS infrastructure isn’t a good use case for these tests. Similarly, validating if AWS is effectively protecting its side of the shared responsibility model isn’t a good test motive. Further, using AWS resources as a source to simulate a DDoS attack on other AWS resources isn’t encouraged. Load tests are performed to gain reliable information on application performance under stress and these are different from DDoS tests. For more information, see the Amazon Elastic Compute Cloud (Amazon EC2) testing policy and penetration testing. Application owners, who have a security compliance requirement from a regulator or who want to test the effectiveness of their DDoS mitigation strategies, typically run DDoS simulation tests.

DDoS simulation tests at AWS

AWS offers two options for running DDoS simulation tests. They are:

  • A simulated DDoS attack in production traffic with an authorized pre-approved AWS Partner.
  • A synthetic simulated DDoS attack with the SRT, also referred to as a firedrill.

The motivation for DDoS testing varies from application to application and these engagements don’t offer the same value to all customers. Establishing clear motives for the test can help you choose the right option. If you want to test your incident response strategy, we recommend scheduling a firedrill with our SRT. If you want to test the Shield Advanced features or test application resiliency, we recommend that you work with an AWS approved partner.

DDoS simulation testing with an AWS Partner

AWS DDoS test partners are authorized to conduct DDoS simulation tests on customers’ behalf without prior approval from AWS. Customers can currently contact the following partners to set up these paid engagements:

Before contacting the partners, customers must agree to the terms and conditions for DDoS simulation tests. The application must be well-architected prior to DDoS simulation testing as described in AWS DDoS Best Practices whitepaper. AWS DDoS test partners that want to perform DDoS simulation tests that don’t comply with the technical restrictions set forth in our public DDoS testing policy, or other DDoS test vendors that aren’t approved, can request approval to perform DDoS simulation tests by submitting the DDoS Simulation Testing form at least 14 days before the proposed test date. For questions, please send an email to [email protected].

After choosing a test partner, customers go through various phases of testing. Typically, the first phase involves a discovery discussion, where the customer defines clear goals, assembles technical details, and defines the test schedule with the partner. In the next phase, partners run multiple simulations based on agreed attack vectors, duration, diversity of the attack vectors, and other factors. These tests are usually carried out by slowly ramping up traffic levels from low levels to desired high levels with an ability for an emergency stop. The final stage involves reporting, discussing observed gaps, identifying actionable tasks, and driving those tasks to completion.

These engagements are typically long-term, paid contracts that are planned over months and carried out over weeks, with results analyzed over time. These tests and reports are beneficial to customers who need to evaluate detection and mitigation capabilities on a large scale. If you’re an application owner and want to evaluate the DDoS resiliency of your application, practice event response with real traffic, or have a DDoS compliance or regulation requirement, we recommend this type of engagement. These tests aren’t recommended if you want to learn the volumetric breaking points of the AWS network or understand when AWS starts to throttle requests. AWS services are designed to scale, and when certain dynamic volume thresholds are exceeded, AWS detection systems will be invoked to block traffic. Lastly, it’s critical to distinguish between these tests and stress tests, in which meaningful packets are sent to the application to assess its behavior.

DDoS firedrill testing with the Shield Response Team

Shield Advanced service offers additional assistance through the SRT, this team can also help with testing incident response workflows. Customers can contact the SRT and request firedrill testing. Firedrill testing is a type of synthetic test that doesn’t generate real volumetric traffic but does post a shield event to the requesting customer’s account.

These tests are available for customers who are already on-boarded to Shield Advanced and want to test their Amazon CloudWatch alarms by invoking a DDoSDetected metric, or test their proactive engagement setup or their custom incident response strategy. Because this event isn’t based on real traffic, the customer won’t see traffic generated on their account or see logs that drive helpful reports.

These tests are intended to generate associated Shield Advanced metrics and post a DDoS event for a customer resource. For example, SRT can post a 14 Gbps UDP mock attack on a protected resource for about 15 minutes and customers can test their response capability during such an event.

Note: Not all attack vectors and AWS resource types are supported for a firedrill. Shield Advanced onboarded customers can contact AWS Support teams to request assistance with running a firedrill or understand more about them.

Conclusion

DDoS simulations and incident response testing on AWS through the SRT or an AWS Partner are useful in improving application security controls, identifying Shield Advanced misconfigurations, optimizing existing detection systems, and improving incident readiness. The goal of these engagements is to help you build a DDoS resilient architecture to protect your application’s availability. However, these engagements don’t offer the same value to all customers. Most customers can obtain similar benefits by following AWS Best Practices for DDoS Resiliency. AWS recommends architecting your application according to DDoS best practices and fine tuning AWS Shield Advanced out-of-the-box offerings to your application needs to improve security posture.

 
If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.

Want more AWS Security news? Follow us on Twitter.

Harith Gaddamanugu

Harith Gaddamanugu

Harith works at AWS as a Sr. Edge Specialist Solutions Architect. He stays motivated by solving problems for customers across AWS Perimeter Protection and Edge services. When he is not working, he enjoys spending time outdoors with friends and family.

The collective thoughts of the interwebz