Appsec adventures

The article explains the confused deputy problem in cloud environments, where a trusted service account can be misused to perform unauthorized actions. It presents two key mitigations: restricting service account trust relationships through least privilege and enforcing contextual authorization checks to ensure delegated access is used only by the intended caller, resource, and workflow. The main takeaway is that valid identities are not enough; cloud IAM must verify who is acting, on whose behalf, and under what conditions.  https://kattraxler.cloud/the-two-mitigations-for-the-service-account-confused-deputy-in-the-cloud

Vectra analyzes the security risks of Azure platform-level managed identities, highlighting how hidden or privileged service identities used by cloud providers can become potential attack paths if misunderstood or improperly governed. The article presents a threat model for these identities, emphasizing the need for visibility into cloud control-plane operations, least-privilege design, identity monitoring, and stronger understanding of implicit trust relationships in cloud environments. https://www.vectra.ai/blog/azures-hidden-operators-a-threat-model-for-platform-level-managed-identities

GEICO explores the evolution toward an agentic software development lifecycle, where AI agents assist across planning, coding, testing, security, and deployment activities. The article discusses how autonomous agents can improve developer productivity and automate repetitive tasks, while highlighting the need for strong governance, security controls, human oversight, and new engineering practices to manage risks introduced by AI-driven development workflows.   https://www.geico.com/techblog/the-agentic-sdlc/

The article explores security risks in API connections between applications and third-party services, focusing on how integrations can expand attack surfaces through excessive permissions, weak authentication, and poor access controls. It highlights the importance of managing API credentials, limiting privileges, monitoring integrations, and treating connected services as part of the overall security boundary.  https://binarysecurity.no/posts/2025/03/api-connections

AWS introduces capabilities in AWS WAF Bot Control to help organizations identify and authenticate legitimate AI agent traffic while distinguishing it from malicious automation. The solution enables better visibility and control over AI-driven requests, helping protect applications from unwanted bots while allowing trusted AI agents to access services securely through verified identities and traffic analysis.  https://aws.amazon.com/pt/blogs/security/authenticate-legitimate-ai-agent-traffic-with-aws-waf-bot-control

AWS introduces OAuth support for the AWS MCP Server, enabling secure authentication and authorization for AI assistants and agents that interact with AWS services through the Model Context Protocol (MCP). The update improves security by allowing identity-based access control, reducing reliance on static credentials, and providing better governance for AI-driven workflows accessing cloud resources.  https://aws.amazon.com/pt/blogs/security/introducing-oauth-support-for-aws-mcp-server