Research catalogue
Publications
187 open-access publications for people responsible for cloud control evidence.
From the desk
187 publicationsGet an alert when Google Cloud project access changes
Build a Google Cloud log-based alert for project IAM changes, verify the filter and notification channel, and understand incident limits.
Detection & response · Google Cloud · By Cloud Security DeskTriage a Google Cloud Security Command Center finding
Review a Security Command Center finding, choose repair or a documented exception, and distinguish resource verification from muting and closure.
Detection & response · Google Cloud · By Cloud Security DeskKeep a Google Cloud Storage bucket private
Use public access prevention and uniform bucket-level access for Cloud Storage, then test IAM readers, signed links, and application dependencies.
Workload security · Google Cloud · By Cloud Security DeskRequire authentication between Cloud Run services
Configure Cloud Run service-to-service authentication with a dedicated caller identity, the right ID token audience, and useful negative tests.
Workload security · Google Cloud · By Cloud Security DeskCall Vertex AI from Cloud Run without a service account key
Use a Cloud Run service account and ADC to call Vertex AI, separate deployment and runtime permissions, and remove an obsolete prototype key.
AI systems · Google Cloud · By Cloud Security DeskRemove unnecessary personal data before sending Vertex AI prompts
Reduce personal data in Vertex AI prompts with field selection, Sensitive Data Protection, deliberate transformations, and safe failure handling.
AI systems · Google Cloud · By Cloud Security DeskRecover deleted Google Cloud Storage objects with soft delete
Choose a Cloud Storage soft delete window, restore a specific object generation, validate its contents, and account for retention and cleanup.
Resilience · Google Cloud · By Cloud Security DeskSet up Cloud SQL backups and prove you can restore
Configure Cloud SQL PostgreSQL backups, understand retention settings, and rehearse a restore through database validation and application cutover.
Resilience · Google Cloud · By Cloud Security DeskGive Azure readers access to one resource group
Assign Reader without granting write access or assuming it grants data access.
Identity & access · Azure · By Cloud Security DeskRead an Azure Key Vault secret from a VM without a password
Set up one system-assigned VM identity and a vault-scoped secret permission.
Identity & access · Azure · By Cloud Security DeskGet an Azure alert when a role assignment changes
Detect successful RBAC changes and test alert delivery without expanding a production role.
Detection & response · Azure · By Cloud Security DeskFind why an Azure VM cannot reach a service
Use a specific source and destination with Network Watcher and separate network reachability from app health.
Detection & response · Azure · By Cloud Security DeskCheck and stop anonymous access to Azure blobs
Understand account and container settings and prove both anonymous denial and intended app access.
Workload security · Azure · By Cloud Security DeskRestrict SSH and RDP access with an Azure network security group
Inspect effective rules, preserve the approved management path and test a fresh connection.
Workload security · Azure · By Cloud Security DeskHandle Azure OpenAI rate limits without retry storms
Separate deployment quota, short request bursts and bounded client retry behavior.
AI systems · Azure · By Cloud Security DeskConnect to Azure OpenAI without an API key
Prove Entra-based inference with a scoped runtime identity before disabling local authentication.
AI systems · Azure · By Cloud Security DeskRecover a deleted Azure blob with soft delete
Choose the right recovery action for a blob, version or container and verify restored bytes.
Resilience · Azure · By Cloud Security DeskRecover a deleted Azure Key Vault secret
Distinguish secret recovery from vault recovery and verify versioned application references.
Resilience · Azure · By Cloud Security DeskDesign application authorization before writing Cedar policies
Define business actions, trustworthy entities and tenant boundaries before writing Cedar policies, then make the application responsible for enforcing the resulting decision.
Identity & access · AWS / Cedar · By Cloud Security DeskKeep Kubernetes audit records useful without logging secrets
Design a question-led Kubernetes audit policy with explicit body limits, rule precedence, lifecycle stages and provider-specific acceptance checks.
Detection & response · Kubernetes / AWS / Azure / Google Cloud · By Cloud Security DeskKeep Terraform plans and state inside the change boundary
Protect Terraform plans and state as sensitive artifacts, and bind production approval to the specific plan, dependencies, workspace and apply identity that will be used.
Workload security · HashiCorp / AWS · By Cloud Security DeskBind confidential GPU inference to a verified key release
Require composite evidence, owner policy and verified recipient binding before confidential inference receives protected key material.
AI systems · NVIDIA / Azure · By Cloud Security DeskMake PostgreSQL point in time recovery reproducible
Build a version-aware recovery chain from protected base backups and WAL through timeline selection, isolated replay and application acceptance.
Resilience · PostgreSQL · By Cloud Security DeskChoose who can share an inference prefix cache
Choose the principals allowed to share prefix state, then carry that decision through request routing, offload, transfer and restore.
AI systems · vLLM / NVIDIA · By Cloud Security Desk