Organizations increasingly leverage Amazon Bedrock to power their Generative AI (GenAI) applications.  Amazon Bedrock provides access to several Foundation Models (FMs) supplied by leading AI companies, including A121 Labs, Anthropic, Cohere, Meta, Mistral AI, Stability AI, and Amazon. Bedrock employs several AI techniques, e.g., fine-tuning and RAG, to empower organizations to build innovative GenAI applications without undergoing rigorous AI processes. Furthermore, Bedrock is serverless, relieving users of infrastructure orchestration and maintenance. However, a firm understanding of the shared responsibility model and its peculiar application to Bedrock is imperative for maintaining a healthy cloud security posture. The risks Bedrock introduces using AWS S3 in the Knowledge Base for the Bedrock component are central to this understanding. This critical Bedrock component manages data retrieval and processing amongst the core Amazon Bedrock components. The vital role played by S3 as a data source is Bedrock's Achilles heel; it introduces several attack vectors, including data poisoning, denial of service, data breach, and S3 ransomware. This blog post delves into these attack vectors, foreseeable impact, detection opportunities, and mitigations.

Bedrock or Bedsand: Attacking Amazon Bedrock’s Achilles Heel

This is the Engineering Culture Podcast, from the people behind InfoQ.com and the QCon conferences.

In this podcast Shane Hastie, Lead Editor for Culture & Methods spoke to Adam Kentosh about the ongoing challenges organisations face in their DevOps DevSecOps and digital transformation journeys.

Read a transcript of this interview: https://bit.ly/3zSd3OW

Subscribe to the Software Architects’ Newsletter for your monthly guide to the essential news and experience from industry peers on emerging patterns and technologies:
https://www.infoq.com/software-architects-newsletter 

Upcoming Events:

QCon San Francisco (November 18-22, 2024)
Get practical inspiration and best practices on emerging software trends directly from senior software developers at early adopter companies.
https://qconsf.com/ 

QCon London (April 7-9, 2025)
Discover new ideas and insights from senior practitioners driving change and innovation in software development.
https://qconlondon.com/ 

Save the date: InfoQ Dev Summit Boston (June 9-10, 2025)
Actionable insights on today’s critical dev priorities.


The InfoQ Podcasts: 
Weekly inspiration to drive innovation and build great teams from senior software leaders. Listen to all our podcasts and read interview transcripts:

- The InfoQ Podcast https://www.infoq.com/podcasts/ 
- Engineering Culture Podcast by InfoQ https://www.infoq.com/podcasts/#engineering_culture 
- Generally AI: https://www.infoq.com/generally-ai-podcast/ 

Follow InfoQ:
- Mastodon: https://techhub.social/@infoq 
- Twitter: twitter.com/InfoQ
- LinkedIn: www.linkedin.com/company/infoq
- Facebook: bit.ly/2jmlyG8
- Instagram: @infoqdotcom
- Youtube: www.youtube.com/infoq

Write for InfoQ:
Learn and share the changes and innovations in professional software development.
- Join a community of experts.
- Increase your visibility.
- Grow your career.
https://www.infoq.com/write-for-infoq

InfoQ Podcast

Transcript

The Ongoing Challenges of DevSecOps Transformation and Improving Developer Experience

There's no reason to be scared about a pen test - especially when it's run by a professional like Brad Causey. I catch up with Brad in this episode to discuss what's recently changed in pen testing in how you test and people's motivations for hiring a pen testing. Interesting and not spooky at all.

Show Links:
Brad on LinkedIn
- https://www.linkedin.com/in/bradcausey/
SecurIT360
- https://www.securit360.com/
- https://www.linkedin.com/company/securit360/
OWASP Testing Guide
- https://owasp.org/www-project-web-security-testing-guide/

OWASP Podcast

ep2024-10 Don't be Scared, It's just a Pen Test with Brad Causey

Some production issues caused this one to slip to December so the intro is a bit off but this is still a great episode. So, learn some lessons on creating secure code from one of my favorite guests: Tanya Janca. It was hard to keep this one to its current length as Tanya is such a great person to talk to for any reason. Enjoy and happy holidays!

Show Links:

Get your copy of Alice and Bob Learn Secure Coding! (and more):
https://shehackspurple.ca/books/
Also the newsletter so that you can join the free online streams:
https://newsletter.shehackspurple.ca/

owasp podcast

ep2024-12 Tanya Janca: Happy Holidays are Secure Code

Enhance security & efficiency with expert DevSecOps managed services. Automate, monitor, & secure your development pipeline for seamless operations.

Secure & Scalable DevSecOps Managed Services for Your Business

The HEAL Security Dispatch Daily Digest is a comprehensive cybersecurity podcast hosted by Richard Simmons from London, providing timely updates and expert insights at the intersection of healthcare and digital security. Each episode delivers a curated briefing on the latest cyber threats, industry responses, and technological developments. In one installment, the podcast covers a range of pressing issues, including credential stuffing attacks targeting The North Face, efforts by Microsoft and CrowdStrike to unify threat actor naming conventions, the emergence of a dangerous Android malware dubbed Crocodilus, and ongoing cybersecurity incidents affecting hospitals across Maine. Additional segments highlight risks posed by malicious AI-generated video ads on social media, a new caregiving feature debuting in Amazon Pharmacy's Medicare services, and the infiltration of counterfeit RubyGems packages threatening software developers. With its focus on real-world threats and proactive solutions, the podcast serves as a trusted daily digest for professionals navigating the evolving cybersecurity landscape. 
https://healsecurity.com/

Credential Stuffing Hits The North Face, and Amazon Pharmacy Expands Medicare Access

Most teams start with the default VPC—but it lacks proper gateways, subnet isolation, and scalability. A well-structured 3-tier VPC (Public, Private, Restricted) with smart CIDR planning ensures security, scalability, and performance from day one. Avoid future tech debt by designing your cloud architecture the right way.

Power your infrastructure with DevSecCops ai — the AI DevOps platform delivering secure, scalable cloud environments with built-in security scanning solutions.

👉 Start building smarter: https://devseccops.ai

Understanding VPC (Virtual Private Cloud) Architecture

As cloud operations scale, how do you gain visibility across all clouds? We uncover the top cloud security trends and challenges in Asia Pacific with Sanjay Yadave. We’ll also explore the role of cloud disaster recovery in minimizing risks and ways to cut its associated costs and complexities.

Nutanix Enterprise Cloud Index www.nutanix.com/enterprise-cloud-index
Nutanix Cloud Interlock: Ask Us Anything event.nutanix.com/cloudinterlock-liveqa/podcast

Securing the cloud as it scales with Sanjay Yadave

Google’s “Big Sleep” AI agent has redefined cybersecurity by spotting a critical SQLite zero-day days before it could be exploited. We’ll glimpse how this autonomous hunter teams up with Sec-Gemini’s AI forensics to slice through mountains of log data in seconds. Then, discover why Google’s FACADE system is the new sentinel for insider-threat detection, catching anomalous behavior with uncanny precision. Join us to find out how sleepless AI guardians are reshaping the front lines of defense.

Bit & Being - Historical First Zero Day Stopped by AI: Meet Big Sleep, Sec-Gemini, Google’s FACADE

In episode 43 of Generationship, Rachel explores the frontier of AI-driven cybersecurity with John Amaral, co-founder of Root.io. Together they unpack the promise and challenges of agentic systems that detect, patch, and remediate vulnerabilities automatically. This installment offers a mix of technical deep dives, AI optimism, and a vision of security that works more like an immune system than a fire alarm.

Subscribe

Generationship - Ep. #43, Security Woven In with John Amaral

The Nutanix Community Podcast is a weekly podcast. It is an informal and technical look at topics around Nutanix, Cloud and the online IT community. It will serve as a campfire and coffee shop for the extended Nutanix community.

Heavybit is the leading early-stage investor in enterprise infrastructure. Since 2013, we've helped launch and scale visionary technical startups—from DevSecOps and feature flagging to AI code generation and beyond. We go hands-on from day 0, backing founders as they turn code into companies and build the future of software from the bottom up to the top down.

The Daily HEAL Security Dispatch Podcast is a leading source for up-to-the-minute news and deep insights in the realm of healthcare cybersecurity and threat intelligence. 

At the heart of HEAL Security's vision is the commitment to equipping organizations and individuals with rapid, contextually rich cybersecurity updates, establishing itself as a pivotal force in unifying practice and data against the ingenious tactics of criminal and malicious entities. HEAL Security is fervently devoted to constructing a robust resource and community that champions the defense of the healthcare sector against the growing cyber threats from organized crime groups and antagonistic nation-states. Our core focus encompasses the protection of vital IT infrastructures, the security of sensitive patient and clinical information, the safeguarding of critical healthcare systems, and the assurance of continuous, undisturbed patient care services.

Empowering businesses with innovative cloud strategies. Transforming digital landscapes. Join us on the journey to harnessing the power of the cloud. #CloudStrategy

DevSecCops ai simplifies cloud onboarding with Kubernetes in 90 mins—no expertise needed. Get IaC, app modernization, CI/CD automation, & AI-powered security fixes.

Software engineers, architects and team leads have found inspiration to build better, high performing teams by listening to the weekly InfoQ Podcast. We have achieved that by interviewing some of the top CTOs, engineers and technology directors from companies like Uber, Netflix and more. Over 500,000 downloads in the last 3 years.

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.

New tracks tagged #devsecops