US Disrupts Massive Cell Phone Array in New York

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/09/us-disrupts-massive-cell-phone-array-in-new-york.html

This is a weird story:

The US Secret Service disrupted a network of telecommunications devices that could have shut down cellular systems as leaders gather for the United Nations General Assembly in New York City.

The agency said on Tuesday that last month it found more than 300 SIM servers and 100,000 SIM cards that could have been used for telecom attacks within the area encompassing parts of New York, New Jersey and Connecticut.

“This network had the power to disable cell phone towers and essentially shut down the cellular network in New York City,” said special agent in charge Matt McCool.

The devices were discovered within 35 miles (56km) of the UN, where leaders are meeting this week.

McCool said the “well-organised and well-funded” scheme involved “nation-state threat actors and individuals that are known to federal law enforcement.”

The unidentified nation-state actors were sending encrypted messages to organised crime groups, cartels and terrorist organisations, he added.

The equipment was capable of texting the entire population of the US within 12 minutes, officials say. It could also have disabled mobile phone towers and launched distributed denial of service attacks that might have blocked emergency dispatch communications.

The devices were seized from SIM farms at abandoned apartment buildings across more than five sites. Officials did not specify the locations.

Wait; seriously? “Special agent in charge Matt McCool”? If I wanted to pick a fake-sounding name, I couldn’t do better than that.

Wired has some more information and a lot more speculation:

The phenomenon of SIM farms, even at the scale found in this instance around New York, is far from new. Cybercriminals have long used the massive collections of centrally operated SIM cards for everything from spam to swatting to fake account creation and fraudulent engagement with social media or advertising campaigns.

[…]

SIM farms allow “bulk messaging at a speed and volume that would be impossible for an individual user,” one telecoms industry source, who asked not to be named due to the sensitivity of the Secret Service’s investigation, told WIRED. “The technology behind these farms makes them highly flexible—SIMs can be rotated to bypass detection systems, traffic can be geographically masked, and accounts can be made to look like they’re coming from genuine users.”

Marie’s story: Bringing coding to kids in Tottenham

Post Syndicated from Sophie Ashford original https://www.raspberrypi.org/blog/maries-story-bringing-coding-to-kids-in-tottenham/

We love hearing from members of the community and sharing the stories of amazing young people, volunteers, and educators who are using their passion for technology to create positive change in the world around them.

Marie is a force of nature. As the founder of Breadline London, a grassroots community project in Haringey, she has spent years supporting families with essential services — she’s run a food bank, offered budgeting advice, and hosted well-being workshops. But when she heard about Code Club, she saw another way to help local children: by giving them the skills to shape their futures.

From community support to coding

Marie had no background in tech, but that didn’t stop her. She knew that many families in Tottenham couldn’t afford extracurricular activities like coding classes, and she was determined to change that.

“I’ve wanted a coding club for children, children in Tottenham, because that’s not something that is actually here,” she explains. “Unfortunately for us, we are on the very high end of poverty… and some of our children in this area don’t get the opportunity to attend things like coding club.”

With the support of Haringey Giving and the Raspberry Pi Foundation, Marie launched her Code Club at Tottenham Community Sports Centre. She started from scratch, learning alongside the kids, attending free training at the Raspberry Pi Foundation’s headquarters in Cambridge, and soaking up everything she could about coding.

“I don’t know anything about coding. Nothing. But going to the training days, it was so inspiring. I got so excited thinking, these are the things I can hopefully share with the children.”

Creating a space to experiment

Marie’s club is more than just learning how to code — it’s about teamwork, creativity, and confidence.

Marie helps a young learner with a coding task in her Code Club.

“They need to learn these skills outside of a school environment, outside of a place where it’s really structured. I want them to come in, experiment, make things up as they go along. Sometimes they follow instructions, but mostly, they just try things out.”

She also sees her role as a mentor, even if the kids sometimes know more than she does!

“Most of the children know more about coding than I do. So for me, it’s just about encouraging them: ‘What’s next? What else can you add to your project?’ And helping parents understand that they need to let the children create what they want to create, not just steer them.”

Discovering Coolest Projects

Marie’s journey didn’t stop with Code Club. When she learnt about Coolest Projects, a global showcase where kids celebrate what they’ve built with code, she knew she had to take her club to one of the in-person events.

Marie helps a young learner with a coding task in her Code Club.

“I was in Cambridge when I first heard about it, and this fabulous young woman spoke about Coolest Projects. I just felt so excited to take the children somewhere that’s just kids, just kids learning about coding and developing these amazing things. I even said, ‘Even if no one from my club comes, I’m going by myself!’”

Taking the kids to Coolest Projects was a game-changer. They saw what was possible, talked to other young coders, and left inspired.

“Next year, when we go again, everybody’s going to have a project. Seeing the kids’ faces when adults wanted to try their projects, it was so exciting for them!”

Making a change

Marie is proof that you don’t need to be a tech expert to start a Code Club — you just need passion and a willingness to learn.

Two educators are chatting at a workshop.

Marie’s message to others who are thinking about setting up a coding club but worry about their lack of experience is simple: 

“Start a [Code Club] because the children will help you to run [it]. They will help you. They will help each other. Don’t get put off running a coding club because you don’t know how to code. Because I don’t[…]and I love it.”

Marie’s story is a testament to what’s possible when someone believes in their community and takes action. She is creating opportunities for young people in Tottenham, giving them a space to learn, collaborate, and dream big regardless of their background. We can’t wait to see what her club achieves next!

For more information to help you set up a Code Club in your community, visit codeclub.org.

Help us celebrate Marie and her dedication to opening doors for young creators by sharing her story on X (formerly Twitter), LinkedIn, and Facebook.

The post Marie’s story: Bringing coding to kids in Tottenham appeared first on Raspberry Pi Foundation.

Microsoft Etches Complex Microfluidics Channels Directly into Silicon Chips

Post Syndicated from Patrick Kennedy original https://www.servethehome.com/microsoft-etches-microfluidic-channels-directly-into-silicon-chips-intel/

Microsoft is etching microfluidic channels directly into silicon in research to cool future generations of AI accelerators

The post Microsoft Etches Complex Microfluidics Channels Directly into Silicon Chips appeared first on ServeTheHome.

Научни новини: Храна за пчели, слънцезащита, биосензори и биоинженерна пластмаса

Post Syndicated from Михаил Ангелов original https://www.toest.bg/nauchni-novini-hrana-za-pcheli-sluntsezashtita-biosenzori-i-bioinzhenerna-plastmasa/

Лакомства за пчели

Научни новини: Храна за пчели, слънцезащита, биосензори и биоинженерна пластмаса

Пчелите са едни от ключовите работници в земеделието, чийто труд понякога се приема за даденост. В съвременните производства те са своеобразни наемници – кошерите им се местят близо до културите, които трябва да опрашат, и не е изключение това да става няколко пъти през сезона. Макар да се предполага, че те ще имат достатъчен достъп до цъфтящи растения, от които да си набавят прашец и нектар (т.нар. паша), с разрастващите се климатични промени и човешка дейност понякога цветният прашец се оказва недостатъчен. За справяне с проблема пчеларите рутинно използват подхранване с поленови заместители, но техният състав не е оптимален. Обикновено тези поленови заместители се приготвят от протеинов прах, захари и масла, в които не присъстват важни компоненти от диетата на пчелите.

Подобно на бозайниците, които не могат да синтезират някои витамини и аминокиселини и им се налага да ги приемат с храната си, пчелите са загубили способността да произвеждат стероли, ключово важни за протичането на редица процеси в клетките им. За да си ги набавят, работничките, които се грижат за пилото (съвкупността от яйца, ларви и какавиди), приемат стероли от събрания полен, след което ги концентрират и отделят чрез специализирани жлези в устите си.

Този естествен процес вдъхновява учените за нова разработка, която обещава пълноценна храна за пчелите, помагайки им да запазят висока жизненост на колонията. След като анализират стеролното съдържание на пчелите, изследователи от Оксфорд определят, че най-важни за тези насекоми са шест стерола, като единият от тях (24-MC) съставя 60–70% от общото съдържание на стероли в какавидите. Донякъде очаквано, съотношението между шестте е различно при какавидите на различните видове пчели, което се връзва с познатия ефект от диетата върху развитието на пчелните ларви – в зависимост от приеманата храна ларвите се превръщат в работнички или в пчели майки.

Прицелвайки се в тези шест вещества, екипът се захваща с техния биологичен синтез, избирайки вид дрожди, които натрупват много липиди. Тъй като в естественото си състояние дрождите не синтезират 24-MC, се налагат няколко промени в метаболизма им – премахват се два гена, за да се натрупа прекурсор на желания стерол, и се вмъкват два други гена, кодиращи ензими, които превръщат прекурсора в 24-MC. След като създават този щам на дрождите, учените го модифицират допълнително така, че да натрупва и другите пет стерола. Източниците на гените са най-различни – картоф, киноа, зелени водорасли.

След култивиране на дрождите в биореактори получената биомаса се изсушава, стрива се и се влага в специална храна за пчелите. Резултатите от изпитването ѝ са впечатляващи – колониите, подхранени с нея, отглеждат до 10–15 пъти повече ларви към края на сезона, а продуктивният сезон е по-дълъг. Тъй като изследването е проведено в специални кошери и в контролирани условия, предстоят по-обширни полски изследвания, които да определят дългосрочните ефекти от храната върху здравето на колониите.

Освен по-добрия хранителен ефект, потенциална полза от тази разработка е, че така може да се намали конкуренцията на комерсиално отглежданите пчели с дивите видове. Проучване в Южна Калифорния показва, че медоносните пчели могат да извлекат около 80% от полена в района на пашата си, лишавайки местните видове от важен ресурс. Според авторите медоносните пчели съставляват над 98% от пчелната биомаса в изследваната екосистема, което донякъде се дължи и на по-големия им размер. Но ако хранителните ресурси станат достъпни за местните пчели, техните популации биха се увеличили над 50 пъти.

Този подход може да се приложи и при други видове, например при земните пчели, които са често срещан опрашител в оранжериите. Възможно е и създаване на храни, които да помогнат именно на местните видове да се справят с промените в своите хабитати.

Природна слънцезащита

Макар човешкото тяло да има нужда от слънчева светлина (например за синтез на витамин D), не се препоръчва по-продължително излагане на слънце без някаква защита. Потенциалната вреда се дължи на лъчите в ултравиолетовия спектър (UVA и UVB), които имат голям ефект върху кожата ни. UVA проникват по-дълбоко в нея, причинявайки преждевременното ѝ състаряване и набръчкване. Макар и с по-плитко проникване, UVB имат по-висока енергия и са много по-вредни, тъй като могат да разкъсват веригите на ДНК, което е предпоставка за възникване на мутации, а оттам и на ракови заболявания.

Това налага използването на слънцезащитни препарати, особено когато ще стоим дълго на слънце. През годините са използвани най-различни вещества, но към момента само две от тях са безопасни според Агенцията за контрол на храните и лекарствата на САЩ – цинковият оксид и титаниевият диоксид. Други (оксибензон, октиноксат) се приемат през кожата и могат да нарушат хормоналния баланс, което води до тяхната забрана – оксибензонът е забранен за употреба в Европейския съюз от края на 2023 г. Освен за хората, някои съставки в слънцезащитните кремове са токсични и за морските обитатели – изключително неприятен факт, като се има предвид, че около 25% от слънцезащитата се отмива след 20-минутен престой във водата.

Тъй като защитата от ултравиолетовото лъчение е важна, много организми са развили свои механизми за справяне с неговите вредни ефекти. Пример е спорополенинът – биополимер, който обвива цветния прашец. Спорополенинът е изключително стабилен и здрав заради разнородния си състав, включващ и фенолни съединения, които могат да абсорбират ултравиолетовата светлина.

Тази характеристика на поленовата обвивка се използва в нова разработка на слънцезащитен продукт, който може да се употребява като традиционните препарати, предлагани в момента. За приготвянето му учените изпробват два варианта – прашец от чаен храст и от слънчоглед. Този прашец след двустъпкова обработка образува микрогел. След като с помощта на инвитро отгледани кожни клетки се установява, че е безвреден, се стига и до прякото му изпробване върху лабораторни мишки, изложени на ултравиолетова светлина.

Резултатите от експериментите са обещаващи – кожата на третираните мишки е защитена от вредното влияние на светлината. Това се потвърждава и от ниските нива на експресия на гени, които обикновено се активират при повреди, причинени от слънчево изгаряне. Накратко: защитният ефект на микрогела с прашец от чай е сходен с ефекта от комерсиално предлаган препарат, в чийто състав има редица съставки, които попиват в кожата и могат да причинят промени в хормоналния баланс. Средното ниво на защита се равнява на SPF 27 и това го прави подходящ за ежедневна употреба в слънчево време.

Наред с този добър резултат екипът отбелязва още две важни открития. В сравнение с традиционния слънцезащитен продукт микрогелът поглъща по-малко светлина от видимата и инфрачервената част от спектъра. Това води до значително по-бавно затопляне на кожата и съответно иновативният гел е по-приятен за използване. Другият ефект, значително по-важен, е върху морските обитатели. При отглеждане на корали във вода, в която има комерсиално предлаган продукт, който би трябвало да е безопасен за тях, те се избелват за две седмици. За сравнение, микрогелът от чаен прашец е безвреден дори след два месеца.

Това е пример, че освен питателен ресурс за пчелите, поленът може да бъде суровина и за човека. С оглед на ограничения достъп на опрашителите до полен е трудно да се прецени какво би означавало масовото производство на такъв слънцезащитен продукт за екологичния баланс. От една страна, с него би се намалил доказаният вреден ефект от сегашните продукти за слънцезащита върху морските организми. От друга страна, достъпната храна за пчелите би намаляла, което ще се отрази върху техните популации. Въпросът доколко етично е индустриалното събиране на полен, остава без категоричен отговор. А към момента изкуственият синтез на спорополенин все още изглежда далеч, защото съставът му е неясен и не се знае какъв е точният биосинтетичен път в растенията.

Въпреки това подобни разработки дават надежда, че природата може да ни вдъхнови за създаването на по-щадящи продукти, които в даден момент да станат приложими и да помогнат за опазването ѝ.

Биологични сензори

Микропластмасите са един от по-новите замърсители и ефектът от тях все още не е напълно изяснен, но присъствието им вече е повсеместно – от мозъците ни до далечни ледници. Въпреки широкото им разпространение те са изключително трудни за откриване поради малкия си размер. Към момента при най-често прилаганите методи са нужни дълга пробоподготовка и високотехнологична апаратура, като микроскопи и спектроскопи, поради което процесът е скъп и времеемък.

Възможно решение за по-лесното засичане на микропластмаси е използването на биосензори. Това са системи, които откриват различни вещества чрез биологични процеси. Биологичната част в тях може да е най-различна – от сравнително прости вещества, през по-сложни биомолекули, до цели клетъчни структури. Някои биосензори са вече добре наложени – например антигенните тестове, които придобиха масова популярност след появата на COVID-19. Продължение на този похват е използването на цели организми. Най-често това са бактерии заради малкия им размер, простата им биология и лесното им отглеждане. За разлика от технологиите, в които се използват отделни молекули, тук вече има достъп до целия биологичен апарат на организмите и до всички биохимични процеси, протичащи в тях.

Пример за това е нов генноредактиран щам бактерии, който може да бъде използван за засичане на микропластмаса във води. В бактериите е направена минимална намеса чрез вмъкване на две нови за тях ДНК последователности. Едната е свързана с клетъчната стена на бактериите и е отговорна за засичането на парченцата пластмаса. При контакт с тях тя активира другата ДНК последователност и така започва синтез на зелен флуоресциращ протеин (GFP), който често се използва за визуализация на процеси в клетките.

Първоначално бактериите са изпитани в лабораторни условия върху най-различни видове субстрат. Ако се поставят в епруветки с пясък или стъкло, те не флуоресцират, но ако бъдат изложени на различни видове пластмаса, в рамките на три часа в тях се натрупва GFP, който може да бъде отчетен. За симулация на употребата му в реални условия биосензорът е изпробван с морска вода, която, очаквано, е замърсена с микропластмаси. Интересното е, че след анализа ѝ с помощта на микроспектроскопия се оказва, че замърсяванията са основно от биоразградими пластмаси, върху каквито към момента бактериите не са изпитвани, което показва по-широко действие от предвиденото. Допълнително предимство на системата е, че тя може да се използва за установяване не само на наличието на пластмасови частици, но и на тяхната концентрация, тъй като интензитетът на светлината е правопропорционален на количеството им.

Биосензорът обещава бърз и икономичен метод за количествено определяне на широк набор микропластмаси и подобно на бързите антигенни тестове за COVID-19 има потенциал да предостави възможност за по-интензивно изпитване на различни водоизточници. Това ще помогне за откриване на особено замърсени места, както и за проследяване на източниците на замърсяване.

Биоинженерна пластмаса

Несъмнено замърсяването с пластмаса е сериозен екологичен проблем, който допълнително се разраства от производството на подобни материали, разчитащо на петролни суровини. За съжаление, пластмасите са неразривно свързани със съвременното ни ежедневие и редица продукти не биха били възможни без тях. Поради това търсенето на екологични алтернативи е изключително активно, като особено се ценят биоразградимите пластмаси, за чието производство се използват биологични суровини.

Пример за такава суровина е PDCA (пиридинкарбоксилна киселина) – мономер, който може да се използва за изработката на пластмаса, сходна на PET – материала, познат ни от бутилките за минерална вода. В зависимост от „рецептата“ за приготвяне на полимера, свойствата му могат да се адаптират спрямо конкретното му приложение, като някои варианти дори имат по-висока якост от традиционните пластмаси. Уви, химическият синтез на PDCA е сложен – към момента няма процес със задоволителен добив.

Добри новини идват от Япония, където екип от Университета в Кобе е разработил нов метод за производство на мономера чрез прецизна ферментация. Учените използват добре познатата бактерия E. coli като малка химическа фабрика, в която вмъкват два биосинтетични пътя. Така бактериите придобиват способността да преобразуват глюкозата от хранителната си среда в PDCA. Това не е първото биоинженерно производство на тази суровина – основите са положени преди 10 години, но новата разработка значително подобрява добива.

След установяването на работеща процедура в лабораторни условия екипът насочва усилията си към оптимизацията на процеса за по-мащабно производство. Потенциален проблем е нуждата от добавяне на вещества в хранителната среда, които спират натрупването на водороден пероксид в бактериите. Той е токсичен за тях, но се образува като вторичен продукт на един от новите гени. Учените вече имат идеи как могат да се справят с него – чрез по-прецизна регулация на този ген или чрез подмяната му със сходен, при който не се отделя толкова пероксид.

Използването на растителни отпадъци като суровина за биологично производство на биоразградими пластмаси звучи изключително футуристично, но подобни разработки показват, че сме изключително близко до това. Освен че са по-щадящи за природата, тези суровини са и по-икономични. Наред с това те дават възможност за създаване на полимери, които имат по-добри свойства от използваните в момента. Биоинженерството и прецизните ферментации могат да се окажат в авангарда не само на производството на хранителни продукти и лекарства, но и на подобни иновативни материали.

Веднъж месечно Михаил Ангелов – биолог, агроном и любим нърд от нашия екип, ни представя най-интересните скорошни новини от различни сфери на науката и обяснява защо тези постижения са толкова значими за света и човечеството. Или най-малкото – любопитни и забавни.

Optimize security operations with AWS Security Incident Response

Post Syndicated from Kyle Shields original https://aws.amazon.com/blogs/security/optimize-security-operations-with-aws-security-incident-response/

Security threats demand swift action, which is why AWS Security Incident Response delivers AWS-native protection that can immediately strengthen your security posture. This comprehensive solution combines automated triage and evaluation logic with your security perimeter metadata to identify critical issues, seamlessly bringing in human expertise when needed. When Security Incident Response is integrated with Amazon GuardDuty and AWS Security Hub within a unified security environment, organizations gain 24/7 access to the AWS Customer Incident Response Team (CIRT) for rapid detection, expert analysis, and efficient threat containment—managed through one intuitive console. Security Incident Response is included with Amazon Managed Services (AMS), which helps organizations adopt and operate AWS at scale efficiently and securely.

In this post, we guide you through enabling Security Incident Response and executing a proof of concept (POC) to quickly enhance your security capabilities while realizing immediate benefits. We explore the service’s functionality, establish POC success criteria, define your configuration, prepare for deployment, enable the service, and optimize effectiveness from day one, helping your organization build confidence throughout the incident response lifecycle while improving recovery time.

Understanding the functionality of Security Incident Response

AWS Security Incident Response service provides comprehensive threat detection and response capabilities through a streamlined four-step process. It begins by ingesting security findings from GuardDuty and select Security Hub integrations with third-party tools. The service then automatically triages these findings using customer metadata and threat intelligence to identify anomalous behavior and suspicious activities. When potential threats are detected, CIRT members proactively investigate cases through the customer portal to determine whether they are true or false positives. For confirmed threats, the service escalates findings for immediate action, while false positives trigger updates to the auto-triage system and suppression rules for GuardDuty and Security Hub, continuously improving detection accuracy.

Comprehensive protection with minimal prerequisites

Security Incident Response delivers powerful security capabilities through seamless integration with both the AWS threat detection and incident response (TDIR) system and third-party security services such as CrowdStrike, Lacework, and TrendMicro. This solution provides a unified command center for end-to-end incident management—from planning and communication to resolution—while ingesting GuardDuty findings and integrating with external providers through Security Hub. With secure case management and an immutable activity timeline, it significantly enhances your security operations by augmenting your security operations center (SOC) and incident response (IR) teams with improved visibility and access to AWS-proven tools and personnel. The AWS CIRT works collaboratively with your responders during investigations and recovery, freeing your valuable resources for other priorities.

The service delivers continuous value through proactive monitoring and response capabilities. It constantly monitors your environment using GuardDuty and Security Hub findings, with service automation, triage, and analysis working diligently in the background to alert you only for genuine security concerns. This protection provides immediate value during potential incidents without demanding your constant attention.

Getting started is straightforward—the only prerequisite is having AWS Organizations enabled and making sure that you have established Organizations with a fundamental organizational unit (OU) structure encompassing member accounts. This foundation not only enables Security Incident Response deployment but also serves as the cornerstone for implementing a robust TDIR strategy across your organization.

Determine success criteria

Establishing success criteria helps benchmark the outcomes of the POC with the goals of the business. Some example criteria include:

  • Designate an incident response team: Identity and document internal team members and external resources responsible for incident response. As highlighted in AWS Well-Architected Security Pillar, having designated personnel reduces triage and response times during security incidents.
  • Develop a formal incident response framework: Develop a comprehensive incident response plan with detailed playbooks and regular table-top exercise protocols. AWS provides a reference library of playbooks on GitHub.
  • Run tabletop exercises: Consider implementing regular simulations that test incident response plans, identify gaps, and build muscle memory across security teams before a real crisis occurs. AWS provides context on various types of tabletop exercises.
  • Identify existing third-party security providers: Identify third-party security providers with Security Hub integrations that feed into Security Incident Response. AWS partners provide findings as documented at Detect and Analyze.
  • Implement GuardDuty: Configure GuardDuty according to best practices to monitor and detect threats across critical services. AWS maintains GuardDuty best practices in AWS Security Services Best Practices for GuardDuty.

Review your success criteria to make sure that your goals are realistic given your timeframe and potential constraints that are specific to your organization. For example, do you have full control over the configuration of AWS services that are deployed in an organization? Do you have resources that can dedicate time to implement and test? Is this time convenient for relevant stakeholders to evaluate the service?

Define your Security Incident Response configuration

After establishing your success criteria and timeline, it’s best practice to define your Security Incident Response configuration. Some important decisions include the following:

  • Select a delegated administrator account: Identify which account will serve as delegated administrator (DA) for Security Incident Response. This account and the AWS Region you select will host the Security Incident Response service and portal. AWS Security Reference Architecture (SRA) recommends using dedicated security tooling account. Review Important considerations and recommendations documentation before finalizing the DA.
  • Define the account scope: Security Incident Response is considered an organization-level service. Every account in every Region within your organization is entitled to coverage under a single subscription. Service coverage automatically adjusts as accounts are added or removed, providing complete protection across your entire AWS footprint.
  • Configure findings sources: Determine which security findings meet your organization’s needs. The service automatically ingests GuardDuty findings organization-wide and select Security Hub finding types from third-party partners. Evaluate which GuardDuty protection plans and Security Hub findings provide the most value for your security posture and incident response capabilities.
  • Develop an escalation framework: Establish clear escalation thresholds for different case types: self-managed, AWS-supported, and proactive cases. Define who has authority to determine case submission and type based on severity, impact, and resource requirements.
  • Implement analytics strategy: Determine whether to use native AWS analytics tools (such as Amazon Athena, Amazon OpenSearch, and Amazon Detective) or integrate with existing security information and event management (SIEM) solutions. These capabilities can enrich incident response with contextual data and deeper insights.

Prepare for deployment

After determining success criteria and Security Incident Response configuration, identify stakeholders, desired state, and timeframe. Prepare for deployment by completing:

  • Project plan and timeline: Develop a project plan with defined success criteria, scope boundaries, key milestones, and realistic implementation timelines. Suggested timeline of events:
    • Before enablement:
      • Configure GuardDuty and Security Hub third parties, perform resource planning
      • Request approvals for POC trial from the AWS account team or Service team
    • Day 0 – Enable the service
    • Week 1 – Open reactive CIRT cases
    • Week 2 – Connect to IT service management (ITSM) tools
    • Week 3 – Execute a tabletop exercise
    • Week 4 – Review the reporting provided by CIRT
  • Identify stakeholders: Identify CISO, information security teams, SOC personnel, incident response teams, security engineers, finance, legal, compliance, external MSSPs, and business unit representatives.
  • Develop a RACI matric: Create detailed RACI chart defining roles and responsibilities across incident response lifecycle, facilitating accountability and proper communication channels.
  • Configure management account access: Secure authorization to delegate administrative access. For more information, see Permissions required to designate a delegated Security Incident Response administrator account.
  • Set up IAM roles and permissions: Use AWS Identity and Access Management (IAM) roles to implement role-based access controls aligned with the RACI chart, including case management, escalation, and read-only roles using AWS managed policies. For more information, see AWS Managed Policies

Enable Security Incident Response

With preparations in place, you are ready to enable the service.

Access Security Incident Response in the management account:

  1. Within the organization’s management account, go to the AWS Management Console and search for Security Incident Response in the console search bar.
  2. Choose Sign Up.
  3. Verify that Use delegated administrator account – Recommended is selected, enter the delegated administrator account number in the Account ID field, and choose Next.
  4. Sign in to the delegated administrator account configured in step 3, search for Security Incident Response, and choose Sign up.

Complete setup in the delegated administrator account: 

  1. Define membership details:
    1. Select your home region under Region selection.
    2. For Membership name, enter a suitable name that follows your organization’s naming standards.
    3. Under Membership contacts, enter the Primary and Secondary contact information.
  2. Add Membership tags according to your organization’s tagging strategy.
  3. Choose Next.
  4. Configure permissions for proactive response:
    1. Service permissions for proactive response is already enabled, but you can disable this feature if needed.
    2. Select By choosing this option… and choose Next.
    3. Review service permissions and choose Next.
  5. Review the membership configuration and details, then choose Sign up.
  6. The service-linked role created with proactive response cannot be created in the management account through this on-boarding process. See the AWS Security Incident Response User Guide for deploying the service-linked role to the management account.

Detailed instructions can be found in the YouTube setup video.

Many organizations have well-established processes and application suites for IR and security threat management. To accommodate these pre-existing setups, AWS has developed integrations with popular ITSM and case management applications. Our initial releases enable complete bi-directional integration with both Jira and ServiceNow, with more on the way.

We have provided comprehensive instructions to guide you through the setup process in GitHub.

Optimize value on day one

Immediately after enabling the service, Security Incident Response begins to ingest your GuardDuty and Security Hub findings (from security partners). Your findings are automatically triaged and monitored using deterministic evaluation logic; based on your organization’s unique metadata and security perimeter, high-priority threats are escalated to your Security Incident Response command center for immediate investigation. While your organization receives 24/7 coverage from the start, implementing these recommended optimizations will significantly enhance threat detection accuracy, reduce false positives, accelerate response times, and strengthen your overall security posture through customized protection aligned with your specific business risks and compliance requirements.

To maximize immediate value from Security Incident Response, we suggest using its reactive capabilities beginning at day one. When your team encounters suspicious activities or requires expert investigation, you can create an AWS-supported case through the service portal to engage AWS CIRT specialists directly. These security experts effectively extend your team’s capabilities, providing specialized knowledge and guidance to help you quickly understand, contain, and remediate potential security concerns. This on-demand access to AWS CIRT can reduce your mean time to resolution, minimize potential impact, and make sure you have professional support even for complex security scenarios that might otherwise overwhelm internal resources.

Examples of reactive support queries include:

  • We noticed a suspicious IP address in our environment, performing various API calls. Can you help us investigate?
  • A new account was created two days ago, we were notified through an Amazon EventBridge rule and our endpoint detection and response (EDR) integrations, can you help us scope it and find out who created it? How was it created?
  • An AWS Identity and Access Management (IAM) user is making cross-Region API calls and creating resources in an unused Region.
  • Our EDR solution detected unusual behavior on our production website, indicating a potential breach.
  • Our EDR detected a suspicious web-shell upload and activity. We need help investigating and isolating this.
  • An unauthorized user generated API activity above their authorization level, help us find  privilege escalations.
  • We need help analyzing security logs from our AWS WAF and Amazon Elastic Compute Cloud (Amazon EC2) instances. Are there any Indicators of compromise or suspicious patterns?

Next steps

If you decide to move forward with AWS Security Incident Response and deploy a POC, we recommend the following action items:

  • Determine if you have the approval and budget to use Security Incident Response. Preferred pricing agreements, discounts, and performance-based trials are available.
  • Configure and deploy GuardDuty to help maintain comprehensive and relevant coverage across your management and member accounts, critical services, and workloads.
  • Verify that third-party security tools (such as CrowdStrike, Lacework, or Trend Micro) are properly integrated with Security Hub.
  • Communicate the security incident response tooling changes to the relevant organizational teams.

Conclusion

In this post, we showed you how to plan and implement an AWS Security Incident Response POC. You learned how to do so through phases, including defining success criteria, configuring Security Incident Response, and validating that Security Incident Response meets your business needs.

As a customer, this guide will help you run a successful POC with Security Incident Response. It guides you in assessing the value and factors to consider when deciding to implement the current features.

Additional resources

 
If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.
 

Kyle Shields
Kyle Shields

Kyle is a Security Specialist Solutions Architect focused on threat detection and incident response at AWS. Today, he’s focused on helping enterprise AWS customers adopt and operationalize AWS Security Incident Response and improve their security posture.
Matt Meck
Matt Meck

Matt is a WW Security Specialist with 10 years of experience in technology across AI and cybersecurity, 3 of which are at AWS in the Detection and Response domain. Based out of NY and with a knack for the outdoors, he spends his time playing soccer, skiing, or looking for a new peak to summit.

Accelerating SQL analytics with Amazon Redshift MCP server

Post Syndicated from Ramkumar Nottath original https://aws.amazon.com/blogs/big-data/accelerating-sql-analytics-with-amazon-redshift-mcp-server/

As data analysts and engineers, we often find ourselves switching between multiple tools to explore database schemas, understand table structures, and execute queries across different Amazon Redshift data warehouses. Using natural language to explore metadata and data can simplify this process, but an AI agent often needs the additional context of your Redshift cluster configurations and schemas to successfully discover and build the best execution path.

This is where the Model Context Protocol (MCP) can act as a bridge between the AI agent and your Redshift clusters to provide the necessary information to better support natural language interfaces to your data. MCP is an open standard that enables AI applications to securely connect to external data sources and tools, providing them with rich, real-time context about your specific environment. Unlike static tools, MCP allows AI agents to dynamically discover database structures, understand table relationships, and execute queries with full awareness of your Amazon Redshift setup.

To address these challenges and unlock the full potential of conversational data analysis, Amazon Web Services (AWS) released the Amazon Redshift MCP server, an open source solution that innovates how you interact with Amazon Redshift data warehouses. The Amazon Redshift MCP server integrates seamlessly with Amazon Q Developer command line interface (CLI), Claude Desktop, Kiro, and other MCP-compatible tools. It can enable discover, explore, and analyze your Amazon Redshift metadata and data through natural language conversations with an AI assistant that truly understands your database environment.

In this post, we walk through setting up the Amazon Redshift MCP server and demonstrate how a data analyst can efficiently explore Redshift data warehouses and perform data analysis using natural language queries.

What is the Amazon Redshift MCP Server?

The Amazon Redshift MCP server is a MCP implementation that provides AI agents with safe, structured access to Amazon Redshift resources. It enables:

  • Cluster discovery – Automatically discover both provisioned Redshift clusters and serverless workgroups
  • Metadata exploration – Browse databases, schemas, tables, and columns through natural language
  • Safe query execution – Execute SQL queries in READ ONLY mode with built-in safety protections
  • Multi-cluster support – Work with multiple clusters and workgroups simultaneously for data reconciliation tasks

The MCP server acts as a bridge between Amazon Q CLI and your Amazon Redshift infrastructure, translating natural language requests into appropriate API calls and SQL queries. The following diagram illustrates the high-level architecture.

Figure 1 - High level architecture diagram

The following video demonstrates the solution outlined in this post.

Prerequisites

Before you begin, ensure you have the following:

System requirements

  • Python 3.10 or newer
  • uv package manager (installation guide)
  • Amazon Q CLI or other tools such as Claude Desktop installed and configured

AWS requirements

Required IAM permissions

The user identity needs the following IAM permissions in your access policies:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "redshift:DescribeClusters",
        "redshift-serverless:ListWorkgroups",
        "redshift-serverless:GetWorkgroup",
        "redshift-data:ExecuteStatement",
        "redshift-data:BatchExecuteStatement",
        "redshift-data:DescribeStatement",
        "redshift-data:GetStatementResult"
      ],
      "Resource": "*"
    }
  ]
}

Installation and configuration

The following section covers the steps required to install and configure Amazon Redshift MCP server.

Install required dependencies

Complete the following steps to install required dependencies:

  1. Install the uv package manager if you haven’t already:
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"
  1. Install Python 3.10 or newer:

uv python install 3.10

Configure the MCP server

The MCP server can be configured using several MCP supported clients. In this post we discuss the steps using Amazon Q Developer CLI and Claude Desktop.Complete the following instructions to set up Amazon Q Developer CLI on your host machine and access the Amazon Redshift MCP Server:

  1. Install the Amazon Q Developer CLI.
  2. Configure the Amazon Redshift MCP server in your Amazon Q CLI configuration. Edit the MCP configuration file at ~/.aws/amazonq/mcp.json:
{
  "mcpServers": {
    "awslabs.redshift-mcp-server": {
      "command": "uvx",
      "args": ["awslabs.redshift-mcp-server@latest"],
      "env": {
        "AWS_PROFILE": "default",
        "AWS_REGION": "us-east-1",
        "FASTMCP_LOG_LEVEL": "INFO"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

For further details on installation, refer to the Installation section in the Amazon Redshift MCP server README.md.

  1. Start Amazon Q CLI to verify the MCP server is properly configured:
q chat

/tools

You should notice the Amazon Redshift MCP server initialize successfully in the startup logs.To set up Amazon Q Developer CLI on your host machine and access the Amazon Redshift MCP Server using Claude Desktop, complete the following steps:

  1. Download and install Claude Desktop for your operating system
  2. Open Claude Desktop and in the bottom left, choose the gear icon to navigate to Settings
  3. Choose the Developer tab and configure your MCP server by adding the same configuration as step 3 in the Amazon Q CLI setup
  4. Restart Claude Desktop to activate the MCP server connection
  5. Test the integration by starting a new conversation and asking: Show me all available Redshift clusters

Use case: Customer purchase analysis

Imagine a practical scenario where a data analyst needs to explore customer purchase data across multiple Redshift clusters. The following walkthrough demonstrates how the MCP server simplifies this workflow.As a data analyst at an ecommerce company, you need to:

  1. Discover available Redshift clusters
  2. Explore the database structure to find customer and sales data
  3. Analyze customer purchase patterns
  4. Generate insights for the business team

To accomplish these tasks, you follow these steps:

  1. Ask Amazon Q to show you available Amazon Redshift resources:
Show me all available Redshift clusters

Amazon Q will use the MCP server to discover your clusters and provide details such as cluster identifiers and types (provisioned or serverless), current status and availability, connection endpoints and configuration, and node types and capacity information.

  1. Explore the database structure to understand your data organization:
What databases and tables are available in the analytics-cluster?

Amazon Q will use the MCP server to systematically explore the objects in the cluster:

  1. Before analyzing data, understand the table schemas:
Show me the structure of the customers and orders tables in analytics-cluster

Amazon Q will use the MCP server to will examine the table columns and provide detailed schema information.

  1. Analyze customer purchase patterns using natural language queries:
Analyze customer purchase pattern from analytics cluster. Show me the top 10 customers by total purchase amount and their buying frequency

Amazon Q will use the MCP server to run the appropriate SQL queries and provide insights.

  1. The MCP server supports analyzing data across multiple clusters:
Compare customer acquisition costs between the analytics-cluster and marketing-cluster data.

Amazon Q will use the MCP server to run the appropriate SQL queries compare the data across analytics-cluster and marketing-cluster.

Best Practices

The MCP server comes equipped with several essential safety protections designed to safeguard your data and system performance. The READ ONLY mode serves as a critical safeguard against unintended data modifications, and we recommend enabling this feature when applicable to your use case. To further enhance security, the server implements query validation mechanisms that scrutinize operations for potential harmful impacts, with user-in-loop validation being recommended for optimal safety. For resource management, the server enforces resource limits to prevent performance-impacting runaway queries, again benefiting from user-in-loop validation for best results. In terms of accessibility, the MCP capability maintains broad availability across all AWS Regions where Amazon Redshift Data API is supported, with throttling limits aligned to existing Amazon Redshift Data API service quotas to ensure consistent performance and reliability.For best results, follow these recommendations:

  1. Start with discovery – Begin by exploring cluster and database structure and tables
  2. Use natural language – Describe what you want to analyze rather than writing SQL directly
  3. Iterate gradually – Build complex analyses step by step
  4. Verify results – Cross-check important findings with business stakeholders
  5. Document insights – Save important queries and results for future reference

Conclusion

The Amazon Redshift MCP server transforms how data analysts interact with Redshift clusters by enabling natural language data exploration and analysis through agentic tooling like Kiro and Amazon Q CLI. By eliminating the need to manually write SQL queries and navigate complex database structures, analysts can focus on generating insights rather than wrestling with syntax and schema discovery.Whether you’re performing a one-time analysis, generating regular reports, or exploring new datasets, the Amazon Redshift MCP server provides a powerful, intuitive interface for your data analysis workflows.Ready to get started? Here’s what to do next:

  1. Install the MCP server following the configuration steps in this post
  2. Explore your Amazon Redshift environment using natural language queries
  3. Start with simple analyses and gradually build complexity
  4. Share insights with your team using the natural language summaries
  5. Provide feedback to help improve the MCP server capabilities

Check out these blog posts to help you navigate using natural language with your use cases:

About the authors

Ramkumar Nottath

Ramkumar Nottath

Ramkumar is a Principal Solutions Architect at AWS focusing on Data and AI services. He enjoys working with various customers to help them build scalable, reliable big data and analytics solutions. His interests extend to various technologies such as analytics, machine learning, generative AI, data warehousing, streaming, and data governance. He loves spending time with his family and friends.

Rohit Vashishtha

Rohit Vashishtha

Rohit is a Senior Analytics Specialist Solutions Architect at AWS based in Dallas, Texas. He has two decades of experience architecting, building, leading, and maintaining big data platforms. Rohit helps customers modernize their analytic workloads using the breadth of AWS services and ensures that customers get the best price/performance with utmost security and data governance.

Lessons from Vibe Coding Three Apps in Three Weeks

Post Syndicated from Jeronimo De Leon original https://www.backblaze.com/blog/lessons-from-vibe-coding-three-apps-in-three-weeks/

A decorative images showing a gear, chips, and the word AI.

While taking some time for paternity leave in a small village in the middle of Bulgaria, I used my baby’s nap times to dive deeper into vibe coding to see just how fast and close these AI tools can get you to building real, production-ready apps. It led to a serious of articles, LinkedIn posts, and product experiments, all focused on understanding and sharing my insights on the state of programming and product design that leverage AI.

In my previous article, “ColabWithMe: A GPT Specialized in Google Colab for Data Analysis & ML,” I talked about how generative AI is redefining the programming landscape. As the Harvard Business Review noted in “We’re All Programmers Now,” this shift represents more than just enabling non-technical employees to code. The real opportunity lies in developing multi-skilled professionals who can operate across domains, compressing innovation cycles from weeks to days. (I explore this further in “The Shape of AI Training: How Skill Profiles Guide AI Learning Paths.“)

Which brings me to what I actually built during those nap times—three different applications using a variety of AI tools. Rather than focusing on polished user interfaces, I focused on backend functionality and core business logic. I discovered that debugging the frontend and getting it to look how I wanted consumed far more time than implementing core backend features. So, many of these vibe-coded apps work nicely on the backend, but need more polish on the frontend. Let’s dig in.

Tools reviewed

Vibe coding means building software by describing what you want in natural language and letting AI generate the code. I tested tools across three categories to see how they enable this new way of building.

  • Integrated development environment (IDE) integrated agents: GitHub Copilot Agent, Gemini Code Assistant, Claude, Cursor.
  • Conversational interfaces: ChatGPT, ChatGPT Codex, Grok, Claude.
  • Prompt app builders: Replit, Lovable, Bolt, GitHub Spark.

Project 1: TickGoals.com, AI-powered goal setting (Approximately 7 hours)

The first application tackled a common productivity challenge: transforming vague aspirations into actionable SMART goals. The system implements a conversational AI interface that guides users through goal refinement, then automatically generates structured milestones and tasks.

Key features:

  • Chat with AI to transform vague goals into structured SMART goals
  • Auto-generate actionable milestones and tasks based on your refined goals
  • To-do list interface for tracking progress and completion
  • Persistent goal storage with progress visualization

Tech stack:

  • React frontend for conversational UI generated by GitHub Spark
  • Firebase Functions for serverless backend processing
  • OpenAI API for goal and task creation
  • Firebase Firestore for persistent goal and task storage

Initially I prototyped across Lovable, Replit, Bolt and GitHub Spark to see what each would generate. I eventually used the code GitHub Spark generated for a cleaner React component structure. Check it out here: https://tickgoals.com

Project 2: NewsVibe.AI, newsletter aggregation and summarization platform (Approximately 12 hours)

While catching up on email, I noticed my inbox was filled with newsletters that I’d often just skim or summarize, so I built a tool to handle this automatically. The app provides users with personalized email addresses for newsletter subscriptions, then presents content in a newsfeed interface to easily scroll through with AI summarization.

Key features:

  • Personal @newsvibe.me email addresses for newsletter subscriptions.
  • Instagram-style scrollable feed displaying all your newsletters.
  • AI-powered summarization to get quick overviews of content.
  • Automatic extraction of links and key information from newsletters.
  • Subscription management dashboard with usage analytics.

Tech stack:

  • Cloudflare pages for frontend hosting.
  • Maileroo for email processing and parsing.
  • Supabase for user management and content storage.
  • Python backend deployed on Render for newsletter and summarization processing.
  • OpenAI API for content summarization.
  • Stripe integration for subscription management.

I split this project into separate frontend and backend repos, and found it blazing fast to build out all the backend functionality first before tackling the frontend.

Project 3: Welcome.AI, newsletter editor agent (Approximately 10 hours)

Welcome AI has been my side project since 2017, initially focused on competitive analysis of AI tools. I’ve rebuilt it multiple times, with the latest iteration using retrieval augmented generation (RAG) for content. But, content curation still required manual review, either by me or community contributors, so I built an agent to automate the entire process, identifying, categorizing, and synthesizing AI news into a publication-ready newsletter. View a generated newsletter here. Subscribe at https://newsletter.welcome.ai/

Key Features:

  • Automatically identifies and filters AI-related news from RSS feeds and newsletters
  • Categorizes stories by topic and summarizes key points
  • Writes complete newsletter copy with insights and summaries
  • Curates the top stories and case studies for featured content sections
  • Generates HTML formatting and generates a feature image for the top story

Tech Stack:

  • Python news feed processing
  • OpenAI Agent SDK and APIs
  • GitHub Actions for automated workflow execution
  • Supabase for content management and curation state
  • Backblaze B2 for generated feature image storage

This was purely a backend project to test and experiment with the OpenAI Agent SDK, though I diverged from it toward more direct large language model (LLM) tasks by the end.

Lessons learned

At a high level, you can definitely see how these tools are going to dramatically speed up development, especially for getting to minimum viable product (MVP) or prototype. You should only need a day or two to get something up and test market traction, especially with prompt app builders.

I found Claude Opus/Claude Code worked best for backend code within the IDE, while Gemini Pro was particularly good at frontend landing page development. Coding agents that make multiple changes across multiple files simultaneously, like those in Cursor, Copilot Agent, or ChatGPT Codex, still felt a bit daunting. I experienced chunks of code being deleted a few times, so I spent considerable time reviewing changes or reverting them.

Prompt app builders like Lovable, Replit, GitHub Spark, and Bolt can get you pretty far, but you can eventually hit a wall where the AI starts breaking more than it fixes, or you need to integrate third-party services that require direct code access. With one project, I started in a prompt builder then moved to an IDE for refinement.

High-level, here are some tips that should help in your vibe coding journey.

Before starting: Set instructions and rules

Like custom instructions in ChatGPT, each tool benefits from coding guidelines: Claude Code uses CLAUDE.md, Copilot uses configured instructions, and Cursor has rules (templates at https://cursor.directory/rules).

A screenshot of provided context for generative code tools.

Both Claude Code and Cursor support MCP (Model Context Protocol) for enhanced integrations (Cursor MCP directory: https://cursor.directory/mcp). Some tools can also index documentation folders for deeper context. Set these up first for better code generation.

Start with a complete product requirements document (PRD)

Before writing any code, spend time iterating with an LLM to generate a thorough PRD. This back-and-forth refinement process goes a long way in providing the context your AI coding tools need. Capture everything: user workflows, UI specifications, technical requirements, and success metrics. Save this in your README.md as your north star.

Prompt app builders like GitHub Spark generate PRDs first from your initial prompt, so the more complete and refined it is, the better.

Define your project structure upfront

Work with the LLM to create a structure that follows best practices but stays simple for what you’re building. An MVP doesn’t need enterprise architecture. Map out where components, services, and APIs belong, and include this in your initial prompt.

A screenshot of the project file structure for one of the vibe coding apps created by Jeronimo De Leon.

Monitor new file generation closely as AI tools can suggest new files when not needed. When this happens, correct it immediately. Keep the structure as simple as possible. Break up files that are doing too many things, as this makes them harder to read and update later.

Add context markers throughout your code

Include file paths and descriptions at the top of each file. This helps the AI maintain context when making changes. Add detailed logging at critical points to track what’s happening when things break. Watch for function renames, LLMs often change function names unnecessarily when updating code, breaking references elsewhere.

Always check current API documentation

LLMs can generate outdated code. OpenAI and Pinecone have changed their import syntax, but AI tools still produce the old versions. Have the LLM search for the latest docs, or check them yourself. Knowing how your services currently work helps you catch these mistakes immediately.

One feature, one conversation

Multitasking with AI means juggling code review while it generates more changes. Keep each conversation focused on a single feature unless features are directly related. When the LLM offers to optimize unrelated areas, decline. If the AI gets stuck repeating failed solutions, start fresh rather than fighting it.

Wisdom of the crowds

When stuck, get code reviews from other LLMs since they can catch different issues. But always review their output carefully. LLMs can duplicate functions across files or, worse, delete essential code. In Agent mode especially, I’ve seen them remove core functionality unrelated to the current task. Give specific instructions about where functions belong and double-check nothing critical disappeared.

Vibe Coding = Product Management + Engineering

The most significant shift with AI-assisted development isn’t the speed; it’s the role change. You’re no longer just implementing; you’re defining what to build, how it should work, and why it matters.

This is the multi-skilled professional evolution I mentioned earlier. When “We’re All Programmers Now,” it means domain experts can build their own solutions, but it also means programmers must become domain experts in product thinking. Success with vibe coding requires clear product vision to articulate requirements, technical knowledge to guide the AI correctly, and relentless focus on user problems.

You become the conductor orchestrating AI capabilities while maintaining the judgment to build what people actually need. The future belongs to these blended roles: product managers who understand engineering deeply enough to guide AI tools, and engineers who think like product managers. These T-shaped and M-shaped professionals operate fluidly across domains. This is how we compress innovation cycles from weeks to days: by eliminating the translation layer between idea and implementation.

The post Lessons from Vibe Coding Three Apps in Three Weeks appeared first on Backblaze Blog | Cloud Storage & Cloud Backup

The collective thoughts of the interwebz