#security - August 2019

Anyone here have any experience with network micro segmentation on AWS? Just starting down the path of researching this subject and looking for links/recommended tools esp./papers

can you elaborate on your usecase?

Anyone tried https://github.com/bitnami-labs/sealed-secrets

This is serious and confirms my suspicions with this well-intentioned but wholly unrealistic provision of GDPR.

This should be a walk in the park for identity thieves. Thieves are already able to social engineer their way through companies with that make it difficult for identify thieves (banks, telephone companies, etc). How are smaller, less sophisticated companies going to be capable of perform sufficient identity verification?

Has anybody used any of the AWS WAF subscriptions? Any feedback?

From reviews, looks like it's really a black box

I have used them

what do you want to know?

They're totally a black box

you can setup some logging now to see what gets blocked, but you have no influence on changing that blocking rule

For compliance reasons, you can setup a "swiss cheese" WAF....and maybe for some protections on some wordpress or static sites.

I can't recommend them else where, but that was my experience with it about 1.25 years ago. If you can afford it, I hear great things about Signal Sciences.

I left a review here a while back: https://aws.amazon.com/marketplace/pp/Fortinet-Inc-Fortinet-Managed-Rules-for-AWS-WAF-Co/B0779D3JYV

@Jonathan Le " no influence on changing that blocking rule" sounds like a non-starter.

Or is there an ability to whitelist/bypass the rules?

It was a large glob of rules when I was using it - not sure if they broke that out in the last year. If they did, I'd imagine that for each exposed rule name you can do "Override to count", which basically makes that specific rule fire with a "[non]fail to open".

If you investigate it, let me know if they expose the rules now.

Did anyone Come across NPM memory Issues ?

Hey, anyone using Pomerium?

I wouldn’t trust any 3rd party proxy/vpn provider to allow access to my internal infrastructure, regardless of the purpose of such infrastructure.