Do This, Not That – Lessons from 7 Headline Grabbing Security Breaches
summary
Seven cloud breaches: a malicious AWS Marketplace AMI runs crypto miners; a leaked root key lets attackers spawn EC2 instances and install miners; a Log4j compromise exposes and deletes 2 million Onus user records and yields a $5M ransom demand; a misconfigured GCS bucket exposes Pfizer PII; NetWalker pivots from cloud to on‑prem and hits ~1,800 systems (backups saved recovery); Peloton API allows unauthenticated profile access; a poisoned PyPI dependency is downloaded ~2,300 times in five days. Fixes are concrete: use trusted images, enforce least privilege, deploy real-time monitoring, patch or WAF, inventory assets, secure secrets, run runtime behavioral analysis and keep reliable backups.
AI-written summary · about
chapters (10)
- 0:00Introduction to cloud security
- 0:44Cloud vs. on-premise threats
- 3:04Supply chain compromise
- 5:30Compromised credentials
- 8:34Ransomware and permissions
- 13:08Misconfigured storage
- 15:44Pivot to on-premise systems
- 20:54Unauthenticated API access
- 23:19Open source dependencies
- 27:26Security trends and takeaways
related talks
48mNine Cloud Security Reasons for Resting Breach Face
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
45mProtecting you from you: Misconfiguration-caused breaches
39mPerils of the cloud
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
22mDevSecOps - The Story of 3 Security Breaches
18mSecuring cloud innovation: Lessons learned
24mLessons from API Breaches: Securing Your Digital Infrastructure