Well done, congratz!

Awesome, congratulations!

I’ve heard good things about the AWS Security Specialty certificate too. I’ve done a course for it which was great, though I never bothered to take the certificate (I don’t feel the need for it). Have you considered it?

Getting rid of long living access keys is such a win.

Adding an SCP to block creation is mentioned last in the blog post, but I’d sat that’s the first thing one should do. That way the problem won’t grow as you remove the existing ones (which might take a lot of time).

Good blog post indeed! Not exactly ground breaking but considering how common the problem is I don’t blame them for writing it.

They say it’s cloud breach by I didn’t see what kind of cloud breach. Did I just miss it or was it not mentioned?

My take so far is that there isn’t really any great options to protect against prompt injections. Simon Wilson presents an idea here on his blog which could is a bit interesting. NVIDIA has open sourced a framework for this as well, but it’s not without problems. Otherwise I’ve mostly seen prompt injection firewall products but I wouldn’t trust them too much yet.

“Beyond the AWS Security Maturity Roadmap” by Rami and “Google Cloud Threat Detection: A Study in Google Cloud” by Day were my favourites. Though I’ve only seen about half so far.

I say most, if not all, are good but since the talks often are niche it depends on what you’re after.

I think this post ended up in the wrong place, I suspect you meant to post it to https://infosec.pub/c/infosecpub

Good points, and I agree!

The list is currently largely made to spark interest and discussion so it’ll likely change a lot. What you mentioned is also brought up on the Brainstorming page. It seems likely that “Inadequate Alignment” will be removed from the list.

Looks like you’re right. It’s not mentioned on that page but here he says he’s the one running it.