Gone are the days of sharing AWS root account credentials in a shared 1Password vault or worse, via email. With this in mind, one of the first steps to securing our AWS account is setting up AWS IAM.
Posts by Category:
- Security
- Access
- Auditing
- Policy
- Zero Trust
- Privileged Access Management
- SOC 2
- DevOps
- Compliance
- Authentication
- Identity and Access Management
- Databases
- Compare
- Team
- Product
- Integrations
- AWS
- Podcasts
- Productivity
- Kubernetes
- SSH
- HIPAA
- ISO 27001
- Dynamic Access Management
- Engineering
- Observability
- Role-Based Access Control
- Secure Access Service Edge
- Webinars
- Events
- NIST
- Onboarding
- Passwordless
- Offsites
- Platform
- PCI
![3 Costly Cloud Infrastructure Misconfigurations](https://discover.strongdm.com/hubfs/Imported_Blog_Media/5f1d52e5d4b365452e149b02_00026-sdm-bg-2000x1000-3.jpg)
It has never been easier for your company to build new infrastructure. In just a few clicks, you can spin up shiny new servers and databases in the cloud and start using them in seconds. However, in the rush to deploy new services so quickly, companies often let information security be an ...
![Physical Facility Access Policy Best Practices](https://discover.strongdm.com/hubfs/Imported_Blog_Media/5f1d556092078c7418196b36_00045-sdm-bg-2000x1000-3.jpg)
In this policy, you will define the controls, monitoring, and removal of physical access to your company’s facilities.
![BYOD Security Policy Guide: 6 Best Practices to Know](https://discover.strongdm.com/hubfs/BYOD-Security-Policy.jpg)
BYOD lets employees use their own smartphones, tablets, or laptops to access company resources and perform work-related tasks, allowing them to work from anywhere. This practice offers advantages like increased productivity and company savings on hardware costs. Employees are often more proficient with their own devices, which can mean a more comfortable work environment and result in higher job satisfaction.
![On-Call Management | Automating Access with PagerDuty and StrongDM](https://discover.strongdm.com/hubfs/623cf0177013b027b72713c3_on-call-management.jpeg)
Production incidents typically require elevated permission to get your services back online quickly, these can be automated.
![Why Fair Eliminated Static Credentials -- A Retrospective](https://discover.strongdm.com/hubfs/Imported_Blog_Media/5f1d532ce73d411abcc534c4_00027-sdm-bg-2000x1000-3.jpg)
Cat Cai is currently the Director of Platform Engineering at Fair. In this talk, alongside Jack Wink and Marshall Brekka, they discuss how Fair eliminated static credentials through automation and tooling decisions. Listen as they walk through how they make sure they enforce least privileged access, and rotate credentials without causing a huge headache in the organization.
![How Splunk Built A Practical Approach to DevSecOps At Scale](https://discover.strongdm.com/hubfs/Imported_Blog_Media/5f1d5437e9c7ec6d0e567091_00039-sdm-bg-2000x1000-2.jpg)
Joel Fulton is the Chief Information Security Officer for Splunk. At Splunk, they've put effort into transforming their organization from a waterfall approach to agile, to now a DevSecOps approach.
![Security Incident Response Policy (SIRP) Explained](https://discover.strongdm.com/hubfs/security-incident-response-policy.png)
This article will point you to the core concepts within a security incident response policy (SIRP) so that you understand the purpose of this policy, challenges, and tools to consider when writing your own.
![Token Security Podcast | Senior Engineering Director at Zymergen on Code Reviews](https://discover.strongdm.com/hubfs/Imported_Blog_Media/5f1d518016da7d305d51f6aa_00014-sdm-bg-2000x1000-3.jpg)
At Token Security our goal is to teach the core curriculum for modern DevSecOps. Each week we will deep dive with an expert so you walk away with practical advice to apply to your team today. No fluff, no buzzwords. This week Jeff Burkhart, Senior Engineering Director at Zymergen talks code reviews, code review fatigue, and what to do when agile becomes tedious.
![How To Prepare For Your First SOC 2 Audit A 30-90-120 Day Plan](https://discover.strongdm.com/hubfs/Imported_Blog_Media/5f1d586fa5d4077fecfaed59_00149-sdm-bg-2000x1000-3.jpg)
Despite thousands of articles, there’s shockingly little actionable advice to help startups complete SOC 2. One area that usually requires some remediation is access controls. Most teams don’t have answers when auditors ask “who has access to a specific database or server and what queries did they execute?” That’s why we started strongDM- to manage and monitor access to every database, server, & environment.
![How to SSH Through Bastion With Key | Part 2 - Tutorial](https://discover.strongdm.com/hubfs/Imported_Blog_Media/605d2d6a167a08c89f896241_StrongDM2-SSH-through-bastion-server-with-key-2.jpg)
How to create an SSH key for your bastion host and ways you can streamline the bastion host login process without compromising the security of the key.
![How to Create a Bastion Host | Part 1 of a Step-by-step Tutorial](https://discover.strongdm.com/hubfs/Imported_Blog_Media/605d2e18679dad4a2e0b7df4_StrongDM-1-AWS-bastion-host-user-flow-3.jpg)
Step-by-step instructions on how to create a bastion host plus how to create an audit trail by logging SSH commands.
![Daniel Leslie Director of Security Intelligence & IT Operations at Namely on the Human Side of Security](https://discover.strongdm.com/hubfs/Imported_Blog_Media/5f1d54200ba49a33eec699d7_00037-sdm-bg-2000x1000-2.jpg)
This week we are joined by Daniel Leslie at Namely who shares his take on the human side of security, and what security at scale looks like for his team. Max, Justin, and Daniel discuss the 3 core things to good company-wide security: psychological safety, vulnerability, and purpose. You have to address these things in a comprehensive manner.