Michael Chan @mchancloud

Father of two boys, guitar and uke player. Identity, GenAI, and security architect. My opinions are my own. linkedin.com/in/mchancloud/ Chicago, IL Joined March 2014

Tweets

905
Followers

1K
Following

310
Likes

1K

Michael Chan @mchancloud

10 months ago

It's these types of exploits that make me extra careful when reviewing the security apps that use LLMs.

Tamir Ishay Sharbat @tamirishaysh

10 months ago

We got ChatGPT to leak sensitive data from your Google Drive data back to OUR servers. And you’ll never even know it happened. All by sharing a single document. A real 0-click data exfil attack. Here’s a detailed breakdown of how we did it 🧵 #DEFCON #BHUSA @mbrg0

5 19 138 31K 89

0 0 0 147 2

View Details

Michael Chan @mchancloud

a year ago

@canva If this isn't reflective of your sales culture, then I'd appreciate a DM on how we can resolve this. My job is to review vendors on their AI-related security controls, and up to now all vendors have willingly complied, enterprise version or not. @canva thoughts?

0 0 0 62 0

View Details

Michael Chan @mchancloud

a year ago

Hey @canva, you told us that you wouldn't answer security questions "without purchase of the Enterprise version". Is this reflective of your attitude towards customers who care about security, privacy, and compliance especially with the concerns everyone has around AI? Do better!

2 0 0 170 0

View Details

Michael Chan @mchancloud

2 years ago

I'd recommend this anyone needed to skill up on AWS IAM!

Tamir Ishay Sharbat @tamirishaysh

10 months ago

5 19 138 31K 89

0 0 0 208 0

View Details

Michael Chan @mchancloud

2 years ago

While not working on ☁️IAM security🔒, I've had to dive in Microsoft Copilot & Copilot Studio security. Copilot Studio is a no/low-code agent and chatbot platform with many integrations to your MS tenant, SNOW, Facebook, etc. Make sure your developers configure this securely!

Michael Bargury @mbrg0

2 years ago

a short summary of all new attack vectors, lol techniques and tools we published at bh/dc (400 words) labs.zenity.io/p/summary-zeni…

0 2 8 721 2

0 0 6 302 0

View Details

Michael Chan @mchancloud

2 years ago

A 🪲 bug with Google Search's AI Overview feature? Either way its completely incoherent.... in repudiateas in scowlas in spurnas in turn downas..!

0 0 0 143 0

View Details

Arynn Crow @arynncrow

2 years ago

ICYMI!

AWS Identity @AWSIdentity

3 years ago

In mid-2024, we're enhancing your sign-in experience. 🌟 Expect a new UI for root & IAM users and an updated switch role page. Improved navigation for a seamless sign in experience. 💡 Discover more in our latest blog: go.aws/3v2jHj7

1 7 12 3K 1

0 1 6 519 0

View Details

Michael Chan @mchancloud

3 years ago

Happy holidays everyone! Wishing you all a happy and secure Christmas season. Gingerbread house kit courtesy of @wiz_io and @SolvangBakery.

0 0 5 396 0

View Details

Ilya Epshteyn @IlyaEpshteyn

3 years ago

Awesome to see this in the docs now! Also check out this great session from @colmmacc where he covers FAS: youtube.com/watch?v=4J8REv…

Michael Chan @mchancloud

3 years ago

👉For those who want more on AWS security internals, we finally have a great page describing Forward Access Sessions, the vehicle by which many AWS services does things on behalf of you. docs.aws.amazon.com/IAM/latest/Use… @AWSIdentity

0 17 54 10K 18

0 1 5 615 1

View Details

Michael Chan @mchancloud

3 years ago

0 17 54 10K 18

View Details

kat traxler @NightmareJS

3 years ago

As of next year, #google will require premium subscriptions for things like IAM Recommender, Role Insights, etc. This is the OPPOSITE of their mantra calling for shared fate instead of the shared responsibility model. A massive loss in credibility.

GCP Weekly @gcpweekly

3 years ago

Policy Intelligence update on September 28, 2023 cloud.google.com/policy-intelli… #googlecloud After January 15, 2024, some Policy Intelligence features will only be available for customers with organization-level activations of Security 1/2

1 0 0 26K 0

4 10 45 20K 6

View Details

Coming from someone reviewing the security controls that can be enabled in Azure, this isn't too comforting. AWS I know has a strong security culture, but much less sure about Microsoft.

Wiz @wiz_io

3 years ago

🔒 What happened? While releasing open-source training datasets, Microsoft's AI research team accidentally left the vault door open 👀 Over 38TB of data (!), including personal backups of employee workstations, private keys, and internal Microsoft Teams messages, were exposed.

5 120 429 114K 58

0 1 0 433 0

View Details

Michael Chan @mchancloud

3 years ago

Google's use of the vuln list cloudvulndb.org to claim better security than other CSP's is a classic example of misusing statistics by not understanding how the data has been curated and represented. @0xdabbad00

2 2 9 727 1

View Details

Michael Chan @mchancloud

3 years ago

@alexadevs I was owed a May 13th payment, but its after 90 days, and according to your policy my money is now forfeit! I really hope this is not the case. I have upcoming payments as well :| Talking with Alexa support has not helped either.

0 0 0 94 0

View Details

Michael Chan @mchancloud

3 years ago

Hey @alexadevs, my Alexa skill has earned $$ the past few months, but it's never been credited to my bank account even though I've provided the info as asked in the developer console. Can you assist? I hope no other devs have this issue!