Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “Evidence”
158 publicationsBuild an inventory of non-human identities across cloud accounts
Find every service account, service principal, role and key across AWS, Entra and Google Cloud, then record the owner, credential type, privilege and last use that turn a list into decisions.
Identity & access · Amazon Web Services / Microsoft Entra / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskEncrypt Kubernetes Secrets at rest with a KMS v2 provider
KMS v2 keeps etcd copies and backups unreadable without an external key, but it does not stop API readers. Configure it, compare what EKS, AKS and GKE already do, and finish key rotations with a rewrite.
Workload security · Kubernetes / Amazon EKS / AWS KMS / Azure Kubernetes Service / Azure Key Vault / Google Kubernetes Engine / Cloud KMS · By Cloud Security DeskCompare managed prompt attack filters in Bedrock, Azure and Vertex AI
Bedrock Guardrails, Azure Prompt Shields and Google Cloud Model Armor all score text for injected instructions. They differ in which content reaches the classifier, how you mark it, and what each one skips.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskPlan for the backlog that follows a regional cloud outage
AWS fixed the DNS fault behind its October 2025 us-east-1 outage within three hours, yet recovery ran into the afternoon. Design retries, queues and capacity automation for that second phase.
Resilience · Amazon Web Services · By Cloud Security DeskNormalize cloud security logs with OCSF before writing detections
OCSF puts CloudTrail, Azure Activity Log and Google audit records into the same API Activity fields. Detections still depend on the mapping, the schema version and provider semantics that normalization does not erase.
Detection & response · Open Cybersecurity Schema Framework / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskBuild a cryptographic inventory for the post-quantum transition
Record where public-key cryptography protects long-lived data and which library, service or vendor must change it. Then rank entries by function and data lifetime, not by how many RSA keys a scanner found.
Workload security · NIST / CISA / Office of Management and Budget / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskTrack EU AI Act deadlines after the Digital Omnibus delay
The Digital Omnibus moved high-risk AI duties to December 2027 and August 2028, but prohibitions, AI literacy and Article 50 transparency already apply. See which dates moved and what cloud teams should build now.
AI systems · European Union / European Commission · By Cloud Security DeskPrepare a cloud exit strategy that satisfies DORA
DORA requires a tested exit plan for every cloud service that supports a critical or important function. This guide turns that duty into dependency maps, measured data exports, staged tests and register entries that agree.
Resilience · European Commission / European Supervisory Authorities / European Central Bank / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskProtect and recover your AWS root account
Protect AWS root access with MFA, current recovery contacts, separate daily administration, and a clear plan for Organizations member accounts.
Identity & access · AWS · By Cloud Security DeskRemove unused AWS access keys without breaking a job
Review IAM access-key usage, find job dependencies, deactivate safely, and verify final deletion without collecting or exposing secret credentials.
Identity & access · AWS · By Cloud Security DeskChoose and verify CloudWatch Logs retention
Choose CloudWatch Logs retention from supported values, verify the saved setting, and account for delayed deletion, archives, and log-group ownership.
Detection & response · AWS · By Cloud Security DeskMake CloudWatch alarms handle missing data correctly
Choose how CloudWatch alarms treat missing data, understand evaluation surprises, test notifications, and preserve useful alarm evidence.
Detection & response · AWS · By Cloud Security DeskKeep an S3 bucket private with Block Public Access
Enable S3 Block Public Access while preserving approved readers. Review the four settings, private CloudFront origins, and practical access tests.
Workload security · AWS · By Cloud Security DeskRemove public SSH access from an EC2 security group
Remove internet-wide EC2 SSH rules after testing Session Manager or restricted SSH. Check all groups, IPv6, fresh sessions, and recovery access.
Workload security · AWS · By Cloud Security DeskCount tokens before sending a prompt to Amazon Bedrock
Count a Bedrock prompt for the chosen model, check endpoint support, distinguish context and output limits, and verify usage without logging prompts.
AI systems · AWS · By Cloud Security DeskRemove a document from an Amazon Bedrock knowledge base
Retire an S3 document from a Bedrock knowledge base through source changes, sync results, retrieval checks, and review of older application copies.
AI systems · AWS · By Cloud Security DeskRecover a deleted file with S3 Versioning
Recover an S3 object by inspecting retained versions, downloading a known copy, or removing the right delete marker without deleting the recovery data.
Resilience · AWS · By Cloud Security DeskChoose an RDS recovery window you can actually restore
Choose RDS backup retention, inspect the real restorable interval, validate an isolated database restore, and record cleanup and recovery limits.
Resilience · AWS · By Cloud Security DeskGive Google Cloud teams access through IAM groups
Give Google Cloud teams IAM access through owned groups, choose a sensible resource scope, and verify migration and removal with practical checks.
Identity & access · Google Cloud · By Cloud Security DeskConnect to a Google Cloud VM with IAP and OS Login
Connect to a Linux VM through IAP and OS Login, check each permission and network layer, and remove old SSH paths with a tested recovery plan.
Identity & access · Google Cloud · By Cloud Security DeskGet an alert when Google Cloud project access changes
Build a Google Cloud log-based alert for project IAM changes, verify the filter and notification channel, and understand incident limits.
Detection & response · Google Cloud · By Cloud Security DeskTriage a Google Cloud Security Command Center finding
Review a Security Command Center finding, choose repair or a documented exception, and distinguish resource verification from muting and closure.
Detection & response · Google Cloud · By Cloud Security DeskKeep a Google Cloud Storage bucket private
Use public access prevention and uniform bucket-level access for Cloud Storage, then test IAM readers, signed links, and application dependencies.
Workload security · Google Cloud · By Cloud Security DeskRequire authentication between Cloud Run services
Configure Cloud Run service-to-service authentication with a dedicated caller identity, the right ID token audience, and useful negative tests.
Workload security · Google Cloud · By Cloud Security Desk