> CLOUD SECURITY THRILLERS · WRITTEN FOR ENGINEERS

Books.

Cloud security thrillers where every CloudTrail event is real, every SQL query is valid, every IAM policy is functional. The technique indices at the back of each book map to MITRE ATT&CK. You can read them as novels. You can read them as incident walkthroughs. Both work.

> Written by Raajhesh Kannaa, cloud security engineer. Same voice as the Weekly Recon.

BOOK I

89 pp · 45-60 min · free PDF

Assumed Role

A detection story.

Maya is the security team at Meridian Financial — all 45 AWS accounts of it. 2:14 AM Thursday, her phone buzzes: StopLogging detected in prod-payments-037. What follows is thirty-two hours of CloudTrail archaeology, false victories, and the realization that one person cannot defend 45 accounts.

TECHNIQUES StopLogging · STS session survival · S3 replication exfil · backdoor IAM users · SCP-based session revocation
DESIGN incident-report grammar — chain-of-custody front matter, IR-phase chapter pills, line-number page footers, a 66-minute CloudTrail blindspot rendered as dead pages, AWS-org endpaper

Read online → Download PDF Field Manual I → About

BOOK II

81 pp · 60-75 min · free PDF

Signed & Sealed

A confession story.

Jess Park runs AppSec at NovaMed, a healthcare SaaS platform for 400 hospitals. Monday 7:12 AM: the hash on a signed image doesn't match what the source tree should have produced. Jess built the pipeline. Jess approved the repo-scoped PAT. Jess deprioritized the signing-key ticket. The antagonist barely appears because the real antagonist is past-tense Jess.

TECHNIQUES GitHub Actions cache poisoning · cosign vs SLSA provenance · DNS exfiltration via Route 53 · FDA §524B cyber escalation · HIPAA §164.402 clock
DESIGN confessional grammar — adverse-event-report front matter, git-log TOC, diff epigraphs, a 7h 14m HIPAA-disclosure gap chart, an FDA-wait WAF scoreboard, a Book III Transit Gateway tease

Read online → Download PDF Field Manual II → About

> FORTHCOMING

Book III

ROUTE TABLE  ·  tgw-rtb-087a…
CIDR            TARGET              TYPE    NOTE
10.20.0.0/16    tgw-attach-a1…      static  hr
10.21.0.0/16    tgw-attach-b2…      static  erp
10.22.0.0/16    tgw-attach-c3…      static  warehouse
0.0.0.0/0       tgw-attach-9f…      static  17:04 — who?

“I thought the hub-spoke was the isolation.”
— D. Okafor, Principal Network Engineer