Identity & Cross Account Access Management in AWS | CLOUD SECURITY - Alexandre Sieira

Identity & Cross Account Access Management in AWS | CLOUD SECURITY - Alexandre Sieira

In this episode of the Virtual Coffee with Ashish edition, we spoke with Alexandre Sieira - Founder @ Tenchi Security

In this episode, Alex & Ashish spoke about

  • What was your path into CyberSecurity?
  • What does Cloud Security mean for you?
  • How is Security different in a cloud world?
  • What are the kind of Identities in AWS?
  • What are the challenges with IT?
  • Identity in AWS vs Identity in Azure?
  • Best practices for Privilege and non-Privilege users in AWS?
  • AWS SSO
  • How important are Domain Accounts in Cloud World/
  • Importance of 2FA?
  • What is Cross Account and why does it matter in Cloud?
  • IAM Role in AWS?
  • AWS STS service in AWS?
  • What about Bio metrics as a 2FA?
  • How does one manage identity across a large cloud landscape?
  • Multi-cloud or Poli-cloud?
  • Security people that know all clouds?
  • How should one manage Root Accounts in AWS?
  • What are the challenges with Identity that people are not talking enough about?
  • Recommendation on good source of AWS security training
  • Thoughts on AWS Cognito?
  • Cognito Research by Andres Riancho- https://andresriancho.com/internet-scale-analysis-of-aws-cognito-security/
  • Auditing IAM using Cloud Spanning - https://github.com/salesforce/cloudsplaining
  • Policy Sentry - https://github.com/salesforce/policy_sentry
  • IAM Policy Generator and AWS Challenges between products

ShowNotes and Episode Transcript on www.cloudsecuritypodcast.tv

Twitter - @kaizenteq @hashishrajan

If you want to watch videos of this and previous episodes:

- Twitch Channel: https://lnkd.in/gxhFrqw

- Youtube Channel: https://lnkd.in/gUHqSai

Jaksot(343)

Browser Security Explained: Consent Phishing, "Click Fix" Attacks & The Limits of EDR

Browser Security Explained: Consent Phishing, "Click Fix" Attacks & The Limits of EDR

Is your security team treating your Identity Provider (IDP) like a firewall? In this episode, Adam Bateman (CEO & Co-founder of Push Security) explains why that's a dangerous mistake and how modern at...

10 Maalis 46min

Is AI Hallucinations a Myth and the Real Threat from AI

Is AI Hallucinations a Myth and the Real Threat from AI

Are attackers really using AI to run end-to-end cyber campaigns? In this episode, Edward Wu (Founder and CEO, DropzoneAI) joins Ashish to separate the hype from reality when it comes to AI-driven atta...

6 Maalis 40min

Why AI Infrastructure is Harder to Secure Than Cloud

Why AI Infrastructure is Harder to Secure Than Cloud

Is AI security just "Cloud Security 2.0"? Toni De La Fuente, creator of the open-source tool Prowler, joins Ashish to explain why securing AI workloads requires a fundamentally different approach than...

20 Helmi 34min

How Attackers Bypass AI Guardrails with Natural Language

How Attackers Bypass AI Guardrails with Natural Language

In the world of Generative AI, natural language has become the new executable. Attackers no longer need complex code to breach your systems, sometimes, asking for a "poem" is enough to steal your pass...

10 Helmi 46min

Vulnerability Management vs. Exposure Management

Vulnerability Management vs. Exposure Management

In this episode, Brad Hibbert (COO & Chief Strategy Officer at Brinqa) joins Ashish to explain why traditional risk-based vulnerability management (RBVM) is no longer enough in a cloud-first world .We...

6 Helmi 39min

Is Developer Friendly AI Security Possible with MCP & Shadow AI

Is Developer Friendly AI Security Possible with MCP & Shadow AI

Is "developer-friendly" AI security actually possible? In this episode, Bryan Woolgar-O'Neil (CTO & Co-founder of Harmonic Security) joins Ashish to dismantle the traditional "block everything" approa...

5 Helmi 1h 3min

Why AI Can't Replace Detection Engineers: Build vs. Buy & The Future of SOC

Why AI Can't Replace Detection Engineers: Build vs. Buy & The Future of SOC

Is the AI SOC a reality, or just vendor hype? In this episode, Antoinette Stevens (Principal Security Engineer at Ramp) joins Ashish to dissect the true state of AI in detection engineering.Antoinette...

21 Tammi 52min

AI Vulnerability Management: Why You Can't Patch a Neural Network

AI Vulnerability Management: Why You Can't Patch a Neural Network

Traditional vulnerability management is simple: find the flaw, patch it, and verify the fix. But what happens when the "asset" is a neural network that has learned something ethically wrong? In this e...

13 Tammi 41min