I saw Vercel had dropped a security harness, which you can use with any agent to scan your repositories for vulnerabilities, validate legitimacy of findings to reduce false positives, assign an owner, and generate a report in markdown.

I stumbled across an account on Twitter this weekend, which was sharing a misconfiguration they had found in a mobile application. The misconfiguration resulted in the private data of hundreds of thousands of vulnerable individuals being made publicly available for anyone to access.

Strong relationships at home and work have been massive for me, but it’s also important to have something outside of that where you can forget about all your day to day stresses. For me that escape came through starting Brazilian JiuJitsu, it’s helped me build resilience, learn something cool, and meet some amazing people - I’d also become a bit of a potato working at a desk the past decade, and I’m starting to feel a lot healthier through actually doing something physical.

If you’re building services in AWS, and want to ensure you have a robust backup and disaster recovery plan, then you’re likely going to explore using the AWS Backup service. It covers a wide array of AWS services, and can also be used for on premise solutions outside of the cloud, but there is a lot to account for, especially as you move beyond the basics. This post will highlight some of the things to be aware of, and help you get set up in a multi-account AWS Organization.

With traditional denial of wallet attacks, it’s a little primitive and chaotic. The tactics are usually centred around creating as many expensive resources as possible before the account owner notices, resulting in potentially significant financial loss. Whereas with AWS Backup Vault Locks, we can assume from the AWS docs that there is no way to rectify an attack targeting immutable backups, besides potentially nuking the account and everything in it.

SLO’s feel like the perfect tool for measuring the security posture of our applications, while taking into account the various contexts and risk profiles of different services and applications. We don’t need a high level security score which covers everything, and we don’t need to apply the same rules across all applications.

I took a day out from the grind this week and attended the first day of the DTX Manchester conference. It was my first time attending this particular conference, despite having the opportunity to attend in the past. The venue is one I’ve been to many times, mostly for music concerts back in the day - although it’s now called Manchester Central, it will always be the G-Mex to me. I was excited for the day ahead, the weather was glorious, and hopefully Northern Rail wouldn’t spoil the occasion.