Kubernetes, K8S, Kabernetes, Kuberneris… como você fala não importa! O que importa é pensar em segurança para os seus containers. 🛡️

• 🔧 Quor
• 📊 Zora
• 🤖 Marvin
• 🎙️ Kubicast
• 👨‍💻 João Brito
• 📘 Livro: Container Security (Liz Rice - 2nd Edition)
• 🧩 Os 12 Fatores

🎵 Music by Karl Casey @ White Bat Audio

💬 Não esqueça de comentar o que achou, participar das enquetes e avaliar — isso ajuda os nossos agentes e IA a ficarem mais motivados! 🚀

José Luiz fala sobre o tema de um jeito leve e descontraído — então dá o play sem culpa!

Afinal, é só apertar um botão… e não é tão complicado assim! 🎧

• 👉 LinkedIn do Zé
• 📘 Livro: Descomplicando a Cibersegurança
• ⚖️ Projeto de Lei n° 2338, de 2023
• 🏛️ NIST
• 📰 Airline held liable for its chatbot giving passenger bad advice — what this means for travellers

Links & Recomendações

• Linkedin da Hive https://www.linkedin.com/company/hive-connect-tech/

• Site https://www.hiveconnect.tech/

• Como fazer parte https://lnkd.in/d692xMym

• Github https://github.com/socialhiveconnect

• E-mail hive.connect.main@gmail.com

Links & Recomendações

• npm debug and chalk packages compromised https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised

• Josh Junon no BlueSky https://bsky.app/profile/bad-at-computer.bsky.social/post/3lydioq5swk2y

• Saiu o IDC MarketScape for ASPM https://www.wiz.io/blog/wiz-named-aspm-leader-by-idc

• Observo AI is joining SentinelOne https://www.observo.ai/post/why-observo-and-sentinelone-are-building-the-autonmous-soc-together

• Linux Incident Surface https://tryhackme.com/room/linuxincidentsurface

• NPM dependencies, supply chain attacks, and Bitcoin wallets https://www.blackduck.com/blog/malicious-dependency-supply-chain.html

• PyTorch dependency ‘torchtriton’ on PyPI Supply Chain Attack https://www.sentinelone.com/blog/pytorch-dependency-torchtriton-supply-chain-attack/

• Aikido Safe Chain https://www.npmjs.com/package/@aikidosec/safe-chain

• Supply-Chain Firewall https://github.com/DataDog/supply-chain-firewall

• F5 to acquire CalypsoAI to bring advanced AI guardrails to large enterprises https://www.f5.com/company/news/press-releases/f5-to-acquire-calypsoai-to-bring-advanced-ai-guardrails-to-large-enterprises?utm_medium=owned-social&utm_source=linkedin&utm_campiagn=ww-

• Fantasma no Sistema - https://www.amazon.com.br/Fantasma-no-sistema-Kevin-Mitnick/dp/8576087057/ 

• Quadrinho XKCD - https://xkcd.com/2347/ 

Não fomos nos eventos mais hackudo do ano, mas nossos estagiários utilizam algoritmos avançados de IA para trazer para nossos milhares de ouvintes o puro suco do que rolou.

Links & Recomendações

• 307 Cybersecurity Exhibitors at Black Hat 2025 https://stiennon.substack.com?utm_source=navbar&utm_medium=web

• BlackHat USA 2025 Slides https://github.com/onhexgroup/Conferences/tree/main/BlackHat_USA_2025_Slides

• 5 Takeaways From Black Hat x DEF CON 2025 https://open.substack.com/pub/cybersecuritymarketpulse/p/5-takeaways-from-black-hat-x-def?r=363u8u&utm_campaign=post&utm_medium=email

• Black Hat 2025: 10 takeaways you should know https://www.linkedin.com/pulse/black-hat-2025-10-takeaways-you-should-know-warren-atkinson-dfhqe/?trackingId=kErwPpqDTfqaP%2FpBdAvyzQ%3D%3D

• OWASP Top 10 for Large Language Model Applications https://owasp.org/www-project-top-10-for-large-language-model-applications/

• Gartner Predicts that by 2027, 17% of Total Cyberattacks Will Involve Generative AI https://www.gartner.com/en/newsroom/press-releases/2024-08-28-gartner-forecasts-global-information-security-spending-to-grow-15-percent-in-2025

• Hackers atacam ambiente de Pix do HSBC e roubam pelo menos R$ 400 mi https://www.infomoney.com.br/business/hackers-roubam-pelo-menos-r-400-mi-do-hsbc-em-ataque-que-envolve-sinqia-diz-site/

• Datadog guide to Hacker Summer Camp 2025 https://securitylabs.datadoghq.com/articles/hacker-summer-camp-guide-2025/#50-talks-were-excited-to-see

• State of Security 2025 https://www.splunk.com/en_us/form/state-of-security/thanks.html

• 10 Security Vendors Making Big Moves At Black Hat 2025 https://www.crn.com/news/security/2025/10-security-vendors-making-big-moves-at-black-hat-2025

Link & Recomendações 

• The CrowdStrike Outage Was Bad, but It Could Have Been Worse https://www.darkreading.com/vulnerabilities-threats/crowdstrike-outage-was-bad-could-have-been-worse

• Palo Alto Networks Announces Agreement to Acquire CyberArk, the Identity Security Leader https://www.cyberark.com/press/palo-alto-networks-announces-agreement-to-acquire-cyberark/

• AI-Generated Malicious npm Package Drains Solana Funds from 1,500+ Before Takedown https://thehackernews.com/2025/08/ai-generated-malicious-npm-package.html

• A New Chapter for AI and Cybersecurity: SentinelOne Acquires Prompt Security https://www.sentinelone.com/blog/a-new-chapter-for-ai-and-cybersecurity-sentinelone-acquires-prompt-security

• Integrated development environment https://survey.stackoverflow.co/2023/#most-popular-technologies-new-collab-tools

• Decepticon - Vibe Hacking Agent ⁠https://github.com/PurpleAILAB/Decepticon⁠

Link & Recomendações 

• Linkedin do Filipi Pires https://www.linkedin.com/in/filipipires

• Magic Quadrant for Endpoint Protection Platforms https://www.gartner.com/doc/reprints?id=1-2LGE96J2&ct=250715&st=sb

• Lessons Learned From McDonald's Big AI Flub https://www.darkreading.com/application-security/lessons-learned-mcdonalds-ai-flub

• Proteção de credenciais: lições do ataque à C&M https://segura.security/pt-br/post/protecao-de-credenciais-licoes-do-ataque-a-c-m

• awspx https://github.com/ReversecLabs/awspx

• Identiverse  https://identiverse.com/ 

• Links de referência

• Linkedin do Felipe Costa https://www.linkedin.com/in/felipe-dacosta/

• GitHub: https://github.com/felipecosta09

• X: https://x.com/devsecguy
• Artigos: https://medium.com/@devsecguy
• Ultimo artigo https://www.linkedin.com/pulse/vision-one-mcp-democratizing-platform-access-ai-felipe-costa-nlj4c/

Neste episódio Raphael Bottino e Tales Casagrande falam sobre as principais funcionalidades de segurança da AWS e o que rolou no re:Inforce 2025, ficou curioso? Dá o play :) 

Links de referência

• AWS re:Inforce roundup 2025: top announcements https://aws.amazon.com/pt/blogs/aws/aws-reinforce-roundup-2025-top-announcements/

• Amazon Inspector Code Security https://docs.aws.amazon.com/inspector/latest/user/code-security-assessments.html

Threat Hunting não é para qualquer um! Raphael Bottino e Tales Casagrande conversam com Lucas de Assis para explorar os desafios de analisar ameaças em um ambiente tempestuoso como a nuvem.

Link & Recomendações 

• Linkedin do Lucas https://www.linkedin.com/in/lucasdeassis/

• Sigma pra Cloud: https://github.com/SigmaHQ/sigma/tree/master/rules/cloud 
• S3 Ransomware Simulator: ⁠https://github.com/raphabot/s3-ransomware-simulator⁠

• Invictus IR: https://www.invictus-ir.com/ 

• Understanding CloudTrail Events: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html 

• Stratus Red Team: https://github.com/DataDog/stratus-red-team 

Neste episódio Raphael Bottino e Tales Casagrande discutem sobre os relatórios de Segurança, quem nunca leu um relatório que era mais sobre vendas de ferramentas do que levar um conteúdo técnico sobre segurança, vamos analisar e falar sobre alguns relatórios e extrair o suco da informação! Dá o play :)

Chegou a hora do momento mais esperado de todos os tempos.. temos o nosso primeiro convidado! Neste episódio Raphael Bottino e Tales Casagrande se juntam ao Antonio Firmiano e discutem sobre Como AI Agêntica Muda o Panorama de Segurança e dicas revolucionárias que vão resolver todos os seus problemas (sqn)!

Link & Recomendações 

• Model-Driven Dependency Confusion ​​https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

• Explicacao de MCP vs API: ⁠⁠https://medium.com/@elisowski/mcp-explained-the-new-standard-connecting-ai-to-everything-79c5a1c98288⁠⁠

• GitHub Copilot Agent: https://github.blog/news-insights/product-news/github-copilot-meet-the-new-coding-agent/

• Google Jules: https://jules.google/ 

• Agno https://docs.agno.com/introduction

• Papers de Agentic AI https://ia600601.us.archive.org/15/items/google-ai-agents-whitepaper/Newwhitepaper_Agents.pdf
• Anthropic https://www.anthropic.com/engineering/building-effective-agents
• OpenAi https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf⁠ 

Siga o Antonio Firmiano para saber mais sobre o seu projeto https://www.linkedin.com/in/antonio-firmiano-gomes/

Neste episódio Raphael Bottino e Tales Casagrande falam sobre Hanson Ransom no S3. Sabia que a nuvem traz novos desafios quanto a proteção de Ransomware? Dá o play aí, prometo que ninguém vai cantar no seu ouvido. 🌚

• Links de referência

• https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c

• https://raphabot.medium.com/simulating-detecting-and-responding-to-s3-ransomware-attacks-9f85b2a97086?source=friends_link&sk=712f94cf48b7bc46aa29aa652efacaab 

• https://www.sentinelone.com/blog/the-state-of-cloud-ransomware-in-2024/

• https://www.trendmicro.com/en_us/research/24/j/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-stea.html

• https://repost.aws/knowledge-center/potential-account-compromise

Neste episódio Raphael Bottino e Tales Casagrande falam sobre construção, pilares mas não é construção civil é nuvem! Dá o play ai :)

• Links de referência

• AWS Well Architected Framework: https://aws.amazon.com/architecture/well-architected/ 

• AWS Well-Architected Tool https://aws.amazon.com/pt/well-architected-tool/

• Azure Well-Architected Framework: https://learn.microsoft.com/en-us/azure/well-architected/

• Azure Well-Architected Review https://learn.microsoft.com/en-us/assessments/azure-architecture-review/

• Google Cloud Well-Architected Framework:  https://cloud.google.com/architecture/framework

• OCI Well-Architected Framework: https://docs.oracle.com/en/solutions/oci-best-practices/index.html 

• OCI Well-Architected Assessment https://well-architected.oracle.com/apex/r/owwa/well-architected-assessment/home

• Uma analogia sobre o AWS Well-Architected Framework https://medium.com/@100HnoMeuNome/uma-analogia-sobre-o-aws-well-architected-framework-237449062823

• Mapa do AWS Well Architected https://wa.aws.amazon.com/wat.map.en.html

• Well Architected Labs: https://www.wellarchitectedlabs.com/ 

• Skill Builder - AWS Well-Architected Foundations: https://explore.skillbuilder.aws/learn/courses/108/aws-well-architected-foundations 

  
  

• Recomendações

• Bottino: https://www.thefrugalarchitect.com/ 

• Tales: https://github.com/infracost/infracost

  
  

Neste episódio Raphael Bottino e Tales Casagrande falam sobre jornada para nuvem, pizza e o modelo de responsabilidade compartilhada! Mas me responde, qual o seu sabor favorito de pizza?

Referência

• PaaS x IaaS x SaaS x CaaS: qual é a diferença entre elas? ⁠https://cloud.google.com/learn/paas-vs-iaas-vs-saas?hl=pt-BR⁠

• Understanding Cloud Misconfigurations — With Pizza and Lego ⁠https://www.trendmicro.com/en_us/research/21/b/understanding-cloud-misconfigurations-with-pizza-and-lego.html⁠

• HashiCorp 2024 State of Cloud Strategy Survey ⁠https://www.hashicorp.com/pt/state-of-the-cloud⁠

• Modelo de arquitetura do Google Cloud ⁠https://cloud.google.com/architecture/framework?hl=pt-br⁠

• AWS Well-Architected  ⁠https://aws.amazon.com/pt/architecture/well-architected/⁠

• Azure Well-Architected Framework ⁠https://learn.microsoft.com/en-us/azure/well-architected⁠

• Oracle Acknowledges Data Breach and Starts Informing Affected Clients ⁠⁠https://cybersecuritynews-com.cdn.ampproject.org/c/s/cybersecuritynews.com/oracle-acknowledges-data-breach/amp/⁠⁠

• What is lift and shift cloud migration? ⁠⁠⁠https://www.pluralsight.com/resources/blog/business-and-leadership/what-is-lift-and-shift-cloud-migration⁠⁠⁠

  
  

  Links das Indicações:

  
  

• AWS Cloud Quest: Cloud Practitioner ⁠https://explore.skillbuilder.aws/learn/courses/11458/aws-cloud-quest-cloud-practitioner/lessons/42651/play-cloud-quest-cloud-practitioner⁠

• Manual de DevOps: Como Obter Agilidade, Confiabilidade e Segurança em Organizações Tecnológicas ⁠https://a.co/d/2qm3fpq

Hoje é primeiro de abril, mas, nesta conversa, só tem verdades!Raphael Bottino e Tales Casagrande falam sobre conceitos e a utilização do tão falado Cloud Security Posture Management.

Referência

• Modelo de responsabilidade compartilhada https://aws.amazon.com/pt/compliance/shared-responsibility-model/

Links das Indicações:

• CloudFox https://github.com/BishopFox/cloudfox
• Cloudsploit https://github.com/aquasecurity/cloudsploit
• Falco https://github.com/falcosecurity/falco
• AWS Security Digest https://awssecuritydigest.com/

Um podcast sobre Cloud e Application Security! Agora me diz, a culpa é da Segurança ou não?"