Blog category
Practical AWS security guides covering IAM least-privilege, GuardDuty, WAF, Secrets Manager, VPC design, and compliance automation. Built from real remediation work across SOC 2, HIPAA, and PCI-regulated environments.
AWS MadPot saw a PHP2Shell attempt on October 17, 2026, four days before the October 21 patch. Behind an ALB, AWS WAF reads only the first 8 KB of a request body, so the interim rule can miss an upload attack or block real uploads.
Shield Advanced is $3,000/mo per org plus DTO fees. For a consumer marketplace (~180M req/mo CloudFront), cost protection credited $41k in scaling charges after a 38-minute L7 event when WAF rate rules were pre-configured.
Nash OgdenOn a defense-subcontract SaaS (~$42k/mo AWS, CUI in scope), choosing GovCloud (US) over commercial US-East cut inherited-control review from 11 weeks to 4 after mapping 47 customer-responsibility controls in the SSP inheritance worksheet.
Nash OgdenMost remote-access RFPs still default to full Windows desktops, but 60%+ of contractor work is browser-only. WorkSpaces Secure Browser isolates SaaS in AWS; WorkSpaces Applications (formerly AppStream 2.0) streams fat clients without a desktop. A composite regulated services firm cut 3 legacy VDI vendors to 2 OU-scoped patterns and reduced unmanaged-endpoint incidents from ~9/quarter to ~2 after splitting browser vs app streaming.
Nash OgdenProwler finds AWS misconfigurations. This guide covers who remediates findings, IaC fix patterns, Security Hub workflows, and when to bring in AWS security consulting.
Nash OgdenProduction checklist for Prowler and AWS Security Hub: multi-account setup, scheduled scans, finding workflows, and remediation patterns on AWS.
Nash OgdenOn June 15, 2026 AWS made Console Private Access work without internet. VPC endpoints route 100% of browser traffic. First-party benchmark: 161 interface endpoints and ~$263/mo for a 12-service 3-AZ pilot in us-east-1.
Nash OgdenSecurity Hub detects control failures. It is not the compliance pipeline, and treating it as one is why teams still scramble for evidence at audit time. The four jobs are distinct: AWS Config detects drift, conformance packs deploy rules org-wide as immutable bundles, SSM Automation remediates the safe class, and evidence accrues via conformance-pack exports plus Security Hub control status (Audit Manager only if you onboarded before it closed to new customers on 30 April 2026). This post has the tool-per-job matrix, a conformance pack with auto-remediation, and the auto-remediation gotcha to design around.
Nash OgdenWe use cookies and similar technologies to analyze site traffic, personalize content, and provide social media features. By clicking “Accept,” you consent to our use of cookies. You can adjust your preferences at any time.
