Accidental discovery of leveraged permissions into OracleCloud for an OracleCloud customer. 

Reported with screenshots and diagnosis allowing a 0-day security hole to be closed. This post will be updated after a 45 day window. 

2016: Infrastructure as a Service (IAAS) and Application Architecture:

Client requested upgrade of a legacy system for an organization that engages potential voters in U.S. elections across dozens of campaigns. Migrated to a full virtualized IAAS microservices architecture with virtual firewalls, virtual LANs, and virtual DEV/TEST/PROD servers. Negotiated contract for service, did load testing to predict needed allocation of resources, and led team for a successful roll-out, and hosted solution.

Originally setup in MySQL and moved to MariaDB

2001-2006: Lead Application Architect, DBA for system integrating multiple universities' and colleges’ admissions databases into a centralized "Sports Recruiting Management System." Led a team which built the web service used by NCAA schools across the country so that coaches and recruiters could adhere to strict NCAA recruiting and reporting requirements.

Called in to take over networking issues that prior consultants were unable to solve.

After purchasing two competitors, the client was required to maintain connections to the internet and required by vendors have direct WAN connections to 3 third-party vendor networks.

Client had a complex routing issue consisting of multiple Cisco routers, multiple digital lines, managed switches, fiber repeaters, a satellite connection, and the local network.

Back before the days of ipcop, smoothwall, endian, PFSense, and other pre-built systems; linux firewalls were built with ipchains and/or iptables.

2002: Hired by a Fortune 100 client looking to purchase a company and product that offered commercial, enterprise-level , web-based system for project development/management. The company asked me to do a non-destructive security analysis on a production system.

Contracted by private regional hospital for assisting with security issues fpr network of several hundred windows 2000 client computers. Network ran with a central PDC running RedHat linux and Samba. Client was required to implement additional security as part of HIPAA (Health Insurance Portability and Accountability Act of 1996).

Analysis of web server, network and firewall security for client with 10 offices across the Midwest. Issues investigated included: connectivity across multiple T1 lines, migration from Novel to a Windows 2000 cluster, general IP security, database issues and IT security.

Implemented MRTG, DMZ, new routing tables, secondary firewall with an IDS (snort), dual Internet connections with bandwidth sharing. Client passed multiple, third-party, security audits and passed with no issues relevant to work done.

Demo:

Led team in Sprint that in two weeks had designed system to build fully functional in-car demo for one of the world's largest companies integrating web, voice (VXML), traffic, phone and mobile application.  Assisted with sales for final demo which used real-time, in-car, routing, voice-activated system using potential client's in-car, voice-activated system. Stepped in to program the voice activated system leveraging VXML tools when team ran into difficulty. 

Full system: