Projects & Publications

Writing

2020 - ongoing CloudSecDocs

I curate CloudSecDocs.com, a website collecting and sharing my technical notes and knowledge on cloud-native technologies, security, technical leadership, and engineering culture, updated weekly with the best picks from CloudSecList.

2019 - ongoing CloudSecList

official page blog

I curate CloudSecList.com, a newsletter (delivered once per week) that highlights security-related news focused on the cloud native landscape.
Knowing how difficult it is to stay up to date with all the different news and releases occurring in this industry, I hope this will be helpful for other people who are particularly interested in this corner of the security scenario.

If you are interested in sponsoring CloudSecList, please refer to the Sponsor page.

2014 - ongoing Technical Reviewer

Technical reviewer of:

June - October 2018 Cloud Native Devops with Kubernetes
January - December 2014 500 Lines or Less
September 2014 - July 2016 IEEE Journals (e.g., "Transactions on Emerging Topics in Computing (TETCSI)")

Projects

2021 - ongoing Cloud Security Roadmap

official page blog

A framework to establish a cloud security program aimed at protecting a cloud native, service provider agnostic, container-based, offering, aligned with NIST and the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM).

2021 AWS Security Reviewer

source code

Terraform module that automates the setup of roles and users needed to perform a security audit of AWS accounts in an Hub and Spoke model, as described in Cross Account Auditing in AWS and GCP.

In short, this module can be used to create:

One role ("role_security_audit") in every AWS account (Hub + all the Spoke ones), with the built-in "SecurityAudit" policy attached to it.
One role ("role_security_assume"), in the Hub account, able to assume the "role_security_audit" role on all the Spoke accounts.
One IAM user ("user_security_audit"), in the Hub account, able to assume the "role_security_assume" role.

2020 - ongoing CNCF Security Technical Advisory Group (STAG)

official page

I am a member of the CNCF Security Technical Advisory Group (STAG), which facilitates collaboration to discover and produce resources that enable secure access, policy control, and safety for operators, administrators, developers, and end-users across the cloud native ecosystem.

I have also been:

Part of the CNCF committee tasked with creating the Certified Kubernetes Security Specialist (CKS) certification.
Part of the Cloud Native Security Day EU 2021 Program Committee.

2020 - ongoing k8s-lab-plz: A modular Kubernetes Lab

blog source code

k8s-lab-plz is a modular Kubernetes lab which provides an easy and streamlined way to deploy a test cluster (on minikube or baremetal) with support for different components.

Currently supported components are:

Vault
ELK (Elasticsearch, Kibana, Filebeats)
Metrics (Prometheus, Grafana, Alertmanager)
Kafka (Kafka, Zookeeper, KafkaExporter, Entity Operator)
Cartography
Istio
Gatekeeper
Falco
...

Resources:

Introducing k8s-lab-plz: A modular Kubernetes Lab

Kubernetes Lab on Baremetal

Automating Cartography Deployments on Kubernetes

2020 CNCF Security Certification (CKS) Creation

official page

I have been part of the CNCF committee tasked with creating the Certified Kubernetes Security Specialist (CKS) Certification.

The CKS program provides assurance that a CKS has the skills, knowledge, and competence on a broad range of best practices for securing container-based applications and Kubernetes platforms during build, deployment and runtime.

Media:

Certified Kubernetes Security Specialist (CKS) Coming in November

New Kubernetes Security Specialist Certification to Help Professionals Demonstrate Expertise in Securing Container-Based Applications

CNCF - Kubernetes Security Specialist Certification Now Available

Linux Foundation - Kubernetes Security Specialist Certification Now Available

2019 - 2020 Kritis

source code

Kritis is an open-source solution for securing the software supply chain for Kubernetes applications. Kritis enforces deploy-time security policies using the Google Cloud Container Analysis API and Grafeas.

As part of my contribution, I've helped shipping version 0.2.0, and added support for separating attestations into different GCP projects for images and "AttestationAuthority".

Resources:

Kritis 0.2.0 Release

2019 - ongoing Cartography

source code

I am a maintainer of Cartography, a Python tool that consolidates infrastructure assets and the relationships between them in a graph view powered by a Neo4j database.

As part of my involvement, I'm actively helping define the long-term roadmap for Cartography, as well as contributing new features and focusing on improving its reliability and speed.

Resources:

[BLOG]

Mapping Moving Clouds: How to stay on top of your ephemeral environments with Cartography

[BLOG]

Tracking Moving Clouds: How to continuously track cloud assets with Cartography

[BLOG]

Automating Cartography Deployments on Kubernetes

[TALK]

Cartography: using graphs to improve and scale security decision-making

Cartography OSS meetings - Youtube Channel

Cartography Meeting Minutes

2018 - 2019 GoScan: An Interactive Network Scanner

blog source code

GoScan is an interactive network scanner client, featuring auto-completion, which provides abstraction and automation over nmap.

Although it started as a small side-project I developed in order to learn @golang, GoScan can now be used to perform host discovery, port scanning, and service enumeration not only in situations where being stealthy is not a priority and time is limited (think at CTFs, OSCP, exams, etc.), but also (with a few tweaks in its configuration) during professional engagements.

GoScan is also particularly suited for unstable environments (think unreliable network connectivity, lack of 'screen', etc.), given that it fires scans and maintain their state in an SQLite database. Scans run in the background (detached from the main thread), so even if connection to the box running GoScan is lost, results can be retrieved asynchronously. That is, data can be imported into GoScan at different stages of the process, without the need to restart the entire process from scratch if something goes wrong.

In addition, the Service Enumeration phase integrates a collection of other tools (e.g., EyeWitness, Hydra, nikto, etc.), each one tailored to target a specific service.

2018 Offensive ELK: Elasticsearch for Offensive Security

blog source code

Offensive ELK is a custom Elasticsearch setup, aiming to show how traditional “defensive” tools can be effectively used for offensive security data analysis, helping your team collaborate and triage scan results.
In particular, Elasticsearch offers the chance to aggregate a multitude of disparate data sources, query them with a unified interface, with the aim of extracting actionable knowledge from a huge amount of unclassified data.

2016 - 2018 Needle: The iOS Security Testing Framework

official page source code twitter

Needle is an iOS Security Testing Framework, released at Black Hat USA in August 2016. It is an open source modular framework which aims to streamline the entire process of conducting security assessments of iOS applications, and acts as a central point from which to do so.
Needle is intended to be useful not only for security professionals, but also for developers looking to secure their code. A few examples of testing areas covered by Needle include: data storage, inter-process communication, network communications, static code analysis, hooking and binary protections.

The release of version 1.0.0 provided a major overhaul of its core and the introduction of a new native agent, written entirely in Objective-C. The new NeedleAgent is an open source iOS app complementary to Needle, that allows to programmatically perform tasks natively on the device, eliminating the need for third party tools.

Needle has been presented at and used by workshops in various international conferences like Black Hat USA/EU, OWASP AppSec and DEEPSEC.

It was included by ToolsWatch in the shortlist for the Top Security Tools of 2016, and it is featured in the OWASP Mobile Testing Guide. It reached #3 on Netsec, the first page of Hacker News, and it was trending on Github.

Talks:

Workshops:

2016 - 2018 Offensive iOS Exploitation Training Course

official page

The Offensive iOS Exploitation workshop is an exercise-driven training course that uses detailed tutorials to guide the attendees through all the steps necessary to exploit a real iOS application, and in the process, provide them an understanding of the modern attacker's mind-set and capabilities. The course cover iOS hacking, from the basics of vulnerability hunting on the platform to advanced exploitation techniques. In addition, this workshop use MWR's newly released "Needle" to identify and exploit all the common mobile application security flaws, over and above the OWASP Mobile Top Ten.

At its conclusion, it will have imparted the information necessary to develop secure and robust applications. Other take-aways will include how to develop secure mobile applications that can withstand advanced attacks, how hackers attack mobile applications and iOS devices, and the most up to date and effective secure coding practices.

Workshops:

2013 - 2018 OWASP

I've been involved in the OWASP Project. Over the years I contributed to projects like the Web Application Top 10 and the Mobile Security Testing Guide.

2011 - 2013 Social Authentication: Vulnerabilities, Mitigations, and Redesign [MSc Thesis]

slides Book

We pointed out the security weaknesses of using Social Authentication (SA) as part of a two-factor authentication scheme, focusing on Facebook's deployment. We have empirically calculated the probability of an attacker obtaining the information necessary to solve SA tests when relying on publicly accessible data as well as following a more active approach to gather restricted information. We have designed an automated attack able to break the SA, to demonstrate the feasibility of carrying out large-scale attacks against social authentication with minimal effort on behalf of an attacker. We then revisited the SA concept and proposed reSA, a two-factor authentication scheme that can be easily solved by humans but is robust against face-recognition software.

Awards:

CyCon 2014

'Innovation in Information Security' Thesis Award

Papers:

Talks:

Conference Talks

Conference Papers

2016-Jan-07 In Depth Security (Proceedings of the DeepSec Conferences)

Book

The article I submitted and presented at DEEPSEC 2014 has been published in the "In Depth Security (Proceedings of the DeepSec Conferences)" book.

2014-Nov-21 Social Authentication: Vulnerabilities, Mitigations, and Redesign

slides video PDF BibTeX

At DEEPSEC 2014 I delivered a talk based on my Master Thesis: "Social Authentication: Vulnerabilities, Mitigations, and Redesign". In addition, an excerpt of the work has been published by the Magdeburger Institut für Sicherheitsforschung in the volume "In Depth Security - Proceedings of the DeepSec Conferences" of the Magdeburger Journal zur Sicherheitsforschung.

Conference:

DEEPSEC

2014-Nov-03 Faces in the Distorting Mirror: Revisiting Photo-based Social Authentication

PDF BibTeX ACM

Conference:

CCS

Authors:

2012-Dec-02 All Your Face Are Belong to Us: Breaking Facebook's Social Authentication

PDF BibTeX ACM

Conference:

ACSAC

Authors:

Subsequent Talks:

Hek.SI 2013

HackCon 2013

ComputerWorld