A pressured cloudy week in cyber !

There have been a lot of pressure this week in cyber and in the cloud ! So much tension, which bring a lot of data flow to share ! 27 points I wanted to share with you, an explosion if cyber news all over the place.

Let's jump to the key points shared this week, what I noticed and you may not want to have missed :

1 - Comparing cloud security is always challenging, and someone shared a great mapping of cloud security controls.

2 - The cloud can't protect your data, so instead, it will let you know if it sees modifications. You may wonder if you get a notification each time you do a modification yourself !

3 - Are you cloud IAM or am I ? 3 Cloud IAM Security Questions You Must Be Able to Answer

4 - That didn't take long. Now, let's see who's checking the CRLs properly (certificate revocation lists) - Malware now using NVIDIA's stolen code signing certificates

5 - A constant reminder, the cloud is infected. Trust nothing, restrict the amount of apps you install. Do not trust big tech ! SharkBot malware hides as Android antivirus in Google Play

6 - That should also ring a bell to any "cloud first" stupidity. Analyst: ‘Only a matter of time’ before U.S. cloud companies shut off services in Russia

7 - Assume compromise - Criminal hackers leak 190GB of alleged Samsung data, source code

8 - These are challenging time when it comes to SAAS Security, as security posture is as blurry as London fog - What NIST SP 800-207 means for SaaS security

9 - A cloud that leaks, so unexpected ! Microsoft fixes critical Azure bug that exposed customer data

10 - Google Buys Cybersecurity Firm Mandiant for $5.4 Billion - This shows that #cybersecurity is not about to cool down (and this post blew my mind with more than 50K views !! )

11 - Remotely blown by the cloud ! (you know, so much cloud news....blows my mind and the UPSs) Widely used UPS devices can be hijacked and destroyed remotely

12 - it's Linux patch time ! And the whole cloud is highly vulnerable as it all runs on Linux.Easily exploitable Linux bug gives root access to attackers (CVE-2022-0847)

13 - Your UEFI system (new bios) is vulnerable and store malwares that survive reboot and re install - New 16 High-Severity UEFI Firmware Flaws Discovered in Millions of HP Devices

14 - Access 7 - Supply Chain vulnerabilities Report (ungated download - so no email to provide or so) - A technical report in which is discussed all the 7 vulnerabilities and their mitigation in details, as well as the lengthy disclosure process followed that led CISA to designate three of the vulnerabilities as critical

15 - Cloud leaks, and it seems not about to stop anytime soon - 70% ServiceNow Instances Misconfigured, Exposed

16 - Big tech will sells you without consent always - Clearview AI fined €20M for collecting Italians’ biometric data

17 - Owners must have the choice to disconnect their car ! Small business owners worried about the cybersecurity of their commercial vehicles (Internet connected vehicles are a huge threat to society, we must be able to keep them offline ! )

18 - Modern problems require modern solutions. Data privacy is becoming a priority ! Good news !

19 - Have you worked on enhancing your security posture ? Conti cyber threat actors remain active and reported Conti ransomware attacks against U.S. and international organizations have risen to more than 1,000. Notable attack vectors include Trickbot and Cobalt Strike

20 - One of the key factor to get proper project sponsors in organizations, it the ability to translate the risk into business meaning so as decision makers understand it. Top 3 Reasons Why You Need Cyber Risk Quantification.

21 - Sorry, your account is compromised, we'll have to cut your finger. ANU goes passwordless.

22 - The sooner victims are aware, the sooner they can defend themselves and take action. SEC wants public companies to report breaches within four days. Because the victim in an incident, is the data owner. The organization that leaks is the careless non trustable data collector.

23 - Now, who's going to trust this one ? Russia creates its own TLS certificate authority to bypass sanctions

24 - What could possibly go wrong ? U.S. eliminates human controls requirement for fully automated vehicles

25 - Telegram as a C2 channel (command & control for malware) - Raccoon Stealer Crawls Into Telegram

26 - Enough bug tech abuses ! Useless innovation, especially when it destroys privacy. Amazon One palm-recognition tech blocked at iconic music venue after artists object to biometric scanning

27 - In the cloud, it's always your fault. What the GCP Shared Responsibility Model is and how security teams can get started - The GCP Shared Responsibility Model: Everything You Need to Know

And that's about it for now ! Wishing you an amazing weekend, we are Saturday already, but one day to enjoy ! Have fun !