Top all-time · #3837
Summit Route
Company blog · summitroute.com/blog · on HN as scottpipersecurity
Summit Route is the company blog at summitroute.com, writing about security. Since 2015, 19 different Hacker News readers have linked it 28 times, most often “AWS Security Maturity Roadmap [pdf]”. The last post was in 2022, but the archive is still widely read.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Summit Route, Scott Piper's AWS security blog and guides. Linked material includes his AWS security maturity roadmap, a weekly infosec news recap, and posts on IAM and AWS SDK client-side monitoring.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
AWS Security Consulting
Most-linked posts?
- AWS Security Maturity Roadmap [pdf]4 people · 4 mentions · first linked 2020-07-02
- Free tools for auditing the security of an AWS account2 people · 2 mentions · first linked 2017-05-30
- S3 backups and other strategies for data durability through ransomware attacks2 people · 2 mentions · first linked 2021-08-06
- /blog/2 people · 2 mentions · first linked 2016-02-07
What Hacker News says?
From https://summitroute.com/blog/2017/01/07/news_summaries/ , some have already been mentioned. - Downclimb (my own), for weekly infosec news summaries: https://summitroute.com/blog/2017/03/12/downclimb/ - Bulletproof TLS, monthly, for crypto and TLS news: https://www.feistyduck.com/bulletproof-tls-newsletter/issue_... - Mobile security news, monthly: http://www.mulliner.org/blog/blosxom.cgi/security/mobile_sec...…
Comment linking /blog/2017/03/12/downclimb/
on “Ask HN: What are some good technology blogs to follow?”Submitted AWS Security Maturity Roadmap [pdf] as a story · 78 points
HN discussionIf you're doing backups for your business, I've written on how to properly encrypt backups[1] and how to use Google Compute Engine for backups[2]. I'm working on write-ups for AWS and Azure that should post within the new few weeks. [1] https://summitroute.com/blog/2016/12/25/creating_disaster_re... [2] https://summitroute.com/blog/2016/12/25/using_google_for_bac...
Comment linking /blog/2016/12/25/using_google_for_backups/
on “Tarsnap – Online backups for the truly paranoid”Submitted “Instagram's Million Dollar Bug”: Case Study for Defense as a story · 70 points
HN discussionTwo basic principles will take you far with regards to AWS security: 1. Avoid long lived credentials (access key/secret key pairs) and IAM users whenever possible, and instead have everything assume roles for access to resources in the same as well as other accounts. Temporary credentials from STS are the way to go. 2. Turn on IMDSv2 by default for EC2 instances. v1 is susceptible to SSRF attacks so even if you’re a…
Comment linking /blog/2020/03/25/aws_scp_best_practices/
on “The State of AWS Security”Submitted Serene – best practice checks on executable binaries as a story · 38 points
HN discussionhttp://highscalability.com/ - For news related to building large web apps and software. https://summitroute.com/blog/ - (mine) Infosec news. http://ben-evans.com/#newsletter - Email only newsletter from Benedict Evans of A16Z mostly related to large mobile business moves. https://www.feistyduck.com/bulletproof-tls-newsletter/ - TLS crypto news (monthly) http://golangweekly.com/ - Golang links
Comment linking /blog/
on “Ask HN: Best curated newsletters?”Submitted The State of ABAC on AWS as a story · 8 points
HN discussionHey! So to touch on a couple of points: Scott Piper is probably one of the most known AWS sec experts, check out his websites. https://summitroute.com/blog/ "Any approaches to formally proving that IAM roles and permissions are secure would be greatly appreciated! " Are you looking for a way to see that you have set up your policies correctly?
Comment linking /blog/
on “Iamlive – Generate an IAM policy from AWS client-side monitoring”Submitted Free tools for auditing the security of an AWS account as a story · 3 points
HN discussionIt's a "hidden" (in that it's not documented very well or advertised much by AWS) feature of the AWS SDKs. I think it was likely added for debugging purposes originally, but security tools have started to hook into it as a more local and compete version of the kinds of logs you'd see in CloudTrail. I've used it mostly for debugging and temporary monitoring of service calls. https://summitroute.com/blog/2020/05/25/cl…
Comment linking /blog/2020/05/25/client_side_monitoring/
on “Iamlive – Generate an IAM policy from AWS client-side monitoring”Submitted Free tools for auditing the security of an AWS account as a story · 3 points
HN discussionI'd recommend checking out their "Weekly Infosec News Recap". https://summitroute.com/blog/2015/12/27/downclimb/
Comment linking /blog/2015/12/27/downclimb/
on ““Instagram's Million Dollar Bug”: Case Study for Defense”Submitted A set of challenges to teach security “gotchas” when using AWS as a story · 3 points
HN discussionhttps://summitroute.com/downloads/aws_security_maturity_road... Scott Piper is the definitive AWS security expert, and this is a guide he publishes and maintains. I'd also suggest following him on Twitter, I learn a lot just from his idle tweets. https://twitter.com/0xdabbad00
Comment linking /downloads/aws_security_maturity_roadmap-Summit_Route.pdf
on “How to give access to AWS resources without creating 100s of IAM Users?”Submitted S3 backups and other strategies for data durability through ransomware attacks as a story · 2 points
HN discussionScott Piper's security maturity roadmap [1] is generally well regarded and outlines some recommendations that I would say are fairly "one-size fits most." AWS also recently released their "Foundational Security Best Practices" in Security Hub. [2] [1] https://summitroute.com/downloads/aws_security_maturity_road... [2] https://aws.amazon.com/blogs/security/aws-foundational-secur...
Comment linking /downloads/aws_security_maturity_roadmap-Summit_Route.pdf
on “How to give access to AWS resources without creating 100s of IAM Users?”Submitted AWS Security Maturity Roadmap 2021 as a story · 2 points
HN discussionSubmitted Denial of Wallet Attacks on AWS as a story · 2 points
HN discussionSubmitted How to write security alerts as a story · 2 points
HN discussionSubmitted osxlockdown: a tool to audit for, and remediate, security configuration settings as a story · 2 points
HN discussionSubmitted S3 Backups and Other Strategies Against Ransomware Attacks (2021) as a story · 1 points
HN discussionSubmitted Public dataset of Cloudtrail logs from flaws.cloud as a story · 1 points
HN discussionSubmitted Denial of Wallet Attacks on AWS as a story · 1 points
HN discussionSubmitted AWS Security Maturity Roadmap for 2020 [pdf] as a story · 1 points
HN discussionSubmitted Setting up fREedom and BinNavi as a story · 1 points
HN discussion
