Summit Route
summitroute.com · Company blog · on HN since 2015
Scott Piper's security consultancy blog, covering AWS security, free auditing tools, attack write-ups and a weekly infosec news recap.
What HN saysHN commenters call Piper a leading AWS security expert and recommend his AWS security maturity roadmap and weekly recap.
19HN people shared it
7linked it in comments
17stories submitted
218story points
4 years agolast shared
2015people per year2026
Most-shared posts
- 1AWS Security Maturity Roadmap [pdf]4 people · 79 points · first shared 2020 · 7 comments on HN
- 2Free tools for auditing the security of an AWS account2 people · 6 points · first shared 2017 · discussion on HN
- 3S3 backups and other strategies for data durability through ransomware attacks2 people · 3 points · first shared 2021 · discussion on HN
- 4Denial of Wallet Attacks on AWS2 people · 3 points · first shared 2020 · discussion on HN
- 5Blog2 people · first shared 2016
- 6“Instagram's Million Dollar Bug”: Case Study for Defense1 people · 70 points · first shared 2015 · 3 comments on HN
- 7Serene – best practice checks on executable binaries1 people · 38 points · first shared 2016 · 6 comments on HN
- 8The State of ABAC on AWS1 people · 8 points · first shared 2020 · discussion on HN
- 9A set of challenges to teach security “gotchas” when using AWS1 people · 3 points · first shared 2017 · 1 comments on HN
- 10osxlockdown: a tool to audit for, and remediate, security configuration settings1 people · 2 points · first shared 2015 · discussion on HN
- 11AWS Security Maturity Roadmap 20211 people · 2 points · first shared 2021 · discussion on HN
- 12How to write security alerts1 people · 2 points · first shared 2016 · discussion on HN
- 13Setting up fREedom and BinNavi1 people · 1 points · first shared 2016 · discussion on HN
- 14Public dataset of Cloudtrail logs from flaws.cloud1 people · 1 points · first shared 2020 · discussion on HN
- 15Downclimb1 people · first shared 2017
What HN people wrote when they linked it
sylens · 2022-10-12
Two basic principles will take you far with regards to AWS security:
1. Avoid long lived credentials (access key/secret key pairs) and IAM users whenever possible, and instead have everything assume roles for access to resources in the same as well as other accounts. Temporary credentials from STS are the way to go.
2. Turn on IMDSv2 by default for EC2 instances. v1 is susceptible to SSRF attacks so even if you’re attaching an instance profile to an instance and doing everything else right, you’ve got a problem if somebody finds a weakness in the app running on the instance.
Also heavily recommend checking out Scott Piper’s SCP Best Practices (https://summitroute.com/blog/2020/03/25/aws_scp_best_practices/) that still hold up even if being a few years old at this point.
uzakov · 2021-02-06
Hey!
So to touch on a couple of points: Scott Piper is probably one of the most known AWS sec experts, check out his websites. https://summitroute.com/blog/
"Any approaches to formally proving that IAM roles and permissions are secure would be greatly appreciated! " Are you looking for a way to see that you have set up your policies correctly?
ramimac · 2020-08-18
Scott Piper's security maturity roadmap [1] is generally well regarded and outlines some recommendations that I would say are fairly "one-size fits most." AWS also recently released their "Foundational Security Best Practices" in Security Hub. [2]
[1] https://summitroute.com/downloads/aws_security_maturity_roadmap-Summit…
[2] https://aws.amazon.com/blogs/security/aws-foundational-security-best-p…
staticassertion · 2020-08-18
https://summitroute.com/downloads/aws_security_maturity_roadmap-Summit…
Scott Piper is the definitive AWS security expert, and this is a guide he publishes and maintains. I'd also suggest following him on Twitter, I learn a lot just from his idle tweets.
https://twitter.com/0xdabbad00
_nullandnull_ · 2015-12-27
I'd recommend checking out their "Weekly Infosec News Recap".
https://summitroute.com/blog/2015/12/27/downclimb/
cddotdotslash · 2021-02-06
It's a "hidden" (in that it's not documented very well or advertised much by AWS) feature of the AWS SDKs. I think it was likely added for debugging purposes originally, but security tools have started to hook into it as a more local and compete version of the kinds of logs you'd see in CloudTrail.
I've used it mostly for debugging and temporary monitoring of service calls.
https://summitroute.com/blog/2020/05/25/client_side_monitoring/
scottpiper · 2017-01-28
If you're doing backups for your business, I've written on how to properly encrypt backups[1] and how to use Google Compute Engine for backups[2]. I'm working on write-ups for AWS and Azure that should post within the new few weeks.
[1] https://summitroute.com/blog/2016/12/25/creating_disaster_recovery_bac…
[2] https://summitroute.com/blog/2016/12/25/using_google_for_backups/