Why Your Web Firewall Is an Inside Threat

The attacker never had a password. They just asked a piece of hardware a simple question, and it handed over the keys to 700 storage buckets — because nobody had drawn a hard line between proving who someone is and deciding what they're allowed to touch. In this episode, Ernie and Josée break down the real architectural divide behind that failure: Microsoft Entra ID as the passport office that verifies who you are, and AWS IAM as the mechanical locksmith that's never once asked. We trace how SCIM keeps the two in sync automatically, like an aggressive HR department for the cloud, and how Cedar — AWS's mathematically verified policy language — replaces static role checks with authorization decisions made fresh on every single request. We close with the payoff: an employee in a coffee shop reaching a twenty-year-old Kerberos application with zero VPN, zero exposed ports, and one seamless identity-aware proxy doing the translation invisibly in the background. You'll leave knowing exactly where authentication ends and authorization begins — and why collapsing that line is how a single overprivileged role turns into a headline breach. If you're the one deciding what a cloud role is actually allowed to touch, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott