The podcast discusses the recent lawsuit against SolarWinds and their CISO by the SEC, the ElectraLeak campaign targeting exposed IAM credentials, and security considerations for running containers on Amazon ECS.
C-suite executives may be held personally responsible for misrepresenting security measures.
Regularly monitoring and reviewing IAM credentials can prevent unauthorized access and crypto-jacking operations.
Deep dives
SEC sues SolarWinds and their CISO over security breach
The SEC has sued SolarWinds, as well as their CISO personally, for securities fraud due to misrepresenting their security measures. This serves as a reminder to professionals in C-suite positions that they may be held responsible for the decisions they make. Companies should ensure they accurately represent their security measures to prevent potential legal issues.
ElectraLeak campaign targets exposed IAM credentials
Researchers have identified a campaign called ElectraLeak that specifically targets exposed IAM credentials in publicly accessible repositories. These credentials are then exploited to carry out crypto-jacking operations using EC2 instances. Users are advised to regularly monitor and review their IAM credentials to prevent unauthorized access and ensure only approved workloads are running in their AWS accounts.
1.
C-Suite Responsibility and Security Considerations for Running Containers on Amazon ECS
Last week in security news: The SEC has sued Soalrwinds as well as their CISO, Tracking Malicious Operations of Exposed IAM Keys, Security considerations for running containers on Amazon ECS, and more!