Cloud Security Alliance, Los Angeles Chapter

Cloud Security Alliance members are invited to the 3rd annual Los Angeles Cyber Security Summit.

Join 400+ industry executives, business leaders, and top-tier solution providers at this interactive day of learning.

Learn from cyber thought leaders such as The CIA Associate Deputy Director, The FBI SSA, the CISO of the City of Los Angeles, and experts from Sony, Verizon, Dell, Pulse Secure, CenturyLink, Forcepoint & many more.

Thursday, November 29, 7:45am – 6pm
The Beverly Hilton
9876 Wilshire Blvd.
Beverly Hills, CA 90210

If you are a C-Suite / Senior Level Executive or Director / Manager of IT / Information Security, you may register for a VIP Discounted Pass to this educational forum with promo code CSA18LA

The first 12 members to register will receive Complimentary Admission. After, Code grants $95 admission (standard price $350).

Details & Registration: https://CyberSummitUSA.com/losangeles18/

Each Pass includes a catered breakfast, lunch & cocktail reception. You will also earn 6 CPE Credits with your Full Day Attendance.

Discuss critical topics that can protect your business from potential threats, including: Incident Response Orchestration, Ransomware, Insider Threat & Corporate Espionage, AI and more.

Advisors & Subject Matter Experts Include (Partial List):

• The CIA: Sean P Roche, Associate Deputy Director of Digital Innovation
• The FBI: Justin Vallese, Supervisory Special Agent
• City of Los Angeles: Timothy Lee, CISO, Information Technology Agency
• Sony Pictures Entertainment: Stevan Bernard, Former Security Chief; Now Heading Bernard Global LLC
• Verizon: David Ostertag, Global Investigations Manager, Investigative Response
• CenturyLink: John Knies, CISO
• ExtraHop Networks: Trish Gundy, Security Engineer
• Dell: Brett Hansen, VP Client Software & General Manager Data Security
• Los Angeles Dept. of Public Health: Richard Greenberg, Information Security Officer; President of ISSA & OWASP Los Angeles Chapters
• Pulse Secure: Jim Hebler, Americas Director of Cyber-Security Solutions Strategies
• Armor: Wayne Reynolds, Head of Security
• Darktrace: Parker Ashley, Director
• Center for Internet Security: Ryan Spelman, Sr. Director
• Forcepoint: Ken Bell, Director of IT Security
• Semtech: Arthur Press, Cyber Security Manager
• K3DES LLC: Miguel Villegas, Senior Vice President
• Inverselogic, Inc: Ara Aslanian, President & CEO

Evaluate the latest cyber security tech solutions from 20+ companies such as Darktrace, Verizon Enterprise Solutions, Dell EMC, CenturyLink, Forcepoint, Pulse Secure, SentinelOne, LogRhythm, Armor, ExtraHop Networks & more.

For full details & to view all upcoming events, visit https://CyberSummitUSA.com

If you have ever had to test Amazon’s AWS services from a blackbox perspective, you will quickly find out how difficult it can be to assess configurations and policies. Luckily, there are several tools that aid in this process and are listed below.

1. prowler – Tool based on AWS-CLI commands for AWS account hardening, following guidelines of the CISAmazon Web Services Foundations Benchmark (https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf)
2. nccgroup/Scout2 – Security auditing tool for AWS environments
3. cloudsploit/scans – AWS security scanning checks
4. The amazon inspector‍ – The default tool Amazon provides.  https://aws.amazon.com/inspector/
5. Netflix/security_monkey – Security Monkey monitors your AWS and GCP accounts for policy changes and alertson insecure configurations
6. Aardvark – Aardvark is a multi-account AWS IAM Access Advisor API
7. Repokid – AWS Least Privilege for Distributed, High-Velocity Deployment
8. DenizParlak/Zeus – AWS Auditing & Hardening Tool that aligns with CIS AWS benchmarks  http://www.denizparlak.com/?p=386
9. Nimbostratus – Tools for fingerprinting and exploiting Amazon cloud infrastructures + video presentation and intro blog post
10. Bucket finder – This is a fairly simple tool to run, all it requires is a wordlist and it will go off and check each word to see if that bucket name exists in the Amazon’s S3 system. Any that it finds it will check to see if the bucket is public, private or a redirect.
11. Cloud Security Suite – One stop tool for auditing the security posture of AWS infrastructure. This tool includes Scout2, Prowler, and Lynis for assessing host configurations.
12. Macie – Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS. Amazon Macie recognizes sensitive data such as personally identifiable information (PII) or intellectual property, and provides you with dashboards and alerts that give visibility into how this data is being accessed or moved.  Currently on available for S3 but support for other data stores will come.

If there are any Cloud Security tools you know about or have experience using, feel free to reach out to our CSA-LA board and we will happily help create another blog post.

Thanks to the Peerlyst post who put this initial list together.