An Illustrated Guide to OAuth and OpenID Connect

OAuth 2.0 and OpenID Connect (OIDC) are internet standards that enable one application to access data from another. Unfortunately, these standards use a lot of jargon and terminology that make them more difficult to understand. 

The goal of these 2 videos are to explain how these standards work using simplified illustrations, and demonstrate in details:

• How to get Google OAuth API keys?
• How OAuth works?
• How to build an OAuth implementation with Node.js?

 

Links:

• https://www.youtube.com/watch?v=t18YB3xDfXI
• https://www.youtube.com/watch?v=Qt3KJZ2kQk0 
• https://github.com/TomDoesTech/Google-OAuth-NodeJS
  

Active Directory Penetration Testing Checklist

A short article that show Active Directory Penetration Testing, including reconnaissance commands and brute force Active Directory.

Links:

• https://gbhackers.com/active-directory-penetration-testing-checklist/
• https://github.com/sense-of-security/ADRecon
  

Defending Public Cloud for Enterprise Tricks and Tips!

 

The public cloud expansion is a reality and maintaining fences up is not easy. Come learn about AWS/Azure/GCP organization rules, policies and best practices to avoid potential threats that help to enforce good practices and avoid potential issues and misconfigurations. 

In this webcast, Moises will cover how to: 

• - Allow new accounts, subscriptions, or project to start with security practices in place 
• - Reduce the risk that shadow IT could grow without security policies and good practices 
• - Enforce security good practices even if users try to resist it 
• - Maintain cloud environments aligned with legal and privacy requirement

 Final Thoughts - Toolbox !

1. Prowler - github.com/toniblyx/prowler
2. Cloud Custodian -  cloudcustodian.io
3. CheckOV - checkov.io
4. CloudSploit - cloudsploit.com
5. rcentry - arcentry.com
6. Falco - falco.org
7. ScoutSuite - github.com/nccgroup/ScoutSuite

Final Thoughts - References!

1. CIS Benchmarks - cisecurity.org
2. Cloud Security Alliance - cloudsecurityalliance.org
3. OWASP - owasp.org
4. NIST - nist.gov
5. ENISA - www.enisa.europe.eu
6. Each cloud provider has well-architecture guide
   

Top 11 Open Source Cloud Security Tools

Top 11 Open Source Cloud Security Tools

• Wazuh Cloud
• Osquery
• GoAudit
• Grapl
• OSSEC
• Suricata
• Zeek/Bro
• Panther
• Kali Linux
• KeePass
• Metasploit Framework

 

Links:

• https://cybersecuritynews.com/cloud-security-tools/
  

Diagram as Code

Diagrams is a library tool that helps you draw the cloud system architecture in Python code. It was born for prototyping a new system architecture design without any design tools. You can also describe or visualize the existing system architecture as well.

Diagrams currently supports main major providers including: AWS, Azure, GCP, Kubernetes, Alibaba Cloud, Oracle Cloud, including On-Premise nodes, SaaS and major Programming frameworks and languages.

Have fun!

Links:

• https://github.com/mingrammer/diagrams
• https://graphviz.gitlab.io/download/
  
• https://www.youtube.com/watch?v=olbvafuGSCw