✳flâneur — a map of the web's best reading

Our Approach to Building Security Tooling | Latacora

latacora.com · 2,364 words · saved by 1 readers

Most “security tools” today are typically composed by code that consumes an API and applies predefined logic to identify issues. This is generally accomplished by: Integrating third party tools into our monitoring platform isn’t always straightforward, as each tool: Additionally, tools are usually designed to only fetch the data that is determined to be useful at a point in time. Often this means fetching the data that’s required in order to evaluate the currently implemented findings. This approach severely limits how useful they can be in other contexts, e.g. when conducting an incident response. Motivated by the above limitations, we have taken a different approach in constructing our monitoring platform and in-house tools, which has come with several advantages. This blog post elaborates on our tooling development strategy, aiming to encourage the adoption of a similar approach in future tool developments across the security industry. Rather than fetching a subset of known-useful e

Our Approach to Building Security Tooling | Latacora Our Approach to Building Security Tooling Nov 01, 2023 11 minutes read 2245 Words ▶ Table of Contents Introduction # Most "security tools" today are typically composed by code that consumes an API and applies predefined logic to identify issues. This is generally accomplished by: Fetching a subset of the endpoints exposed by the service / API being audited (that is, the information required for the evaluation logic, such as a list of the EC2 instances deployed in an AWS account, as well as their configuration) Storing the data retrieved Eval

Explore this link on the map →

related reading