Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “NIST”
129 publicationsDesign AI agents that contain indirect prompt injection
Filters lower the odds that an agent obeys injected text. Architecture decides what an obeying agent can reach. Compare six published patterns and CaMeL by what each removes, what it costs and what it still misses.
AI systems · Google DeepMind / AgentDojo / NIST / OWASP / Microsoft · By Cloud Security DeskMap cloud incident response to NIST SP 800-61 Revision 3
Revision 3 turned NIST's incident handling guide into a CSF 2.0 profile. Translate its rows into provider contracts, cloud evidence, containment authority and recovery ownership, and fix the log defaults first.
Detection & response · NIST / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskGive Kubernetes pods cloud credentials without static keys
EKS Pod Identity, IRSA, AKS Workload ID and Workload Identity Federation for GKE all swap a projected token for short-lived credentials. What leaks if you stop there is the node's own identity.
Identity & access · Amazon Web Services / Microsoft Azure / Google Cloud / Kubernetes · By Cloud Security DeskContain failures with cell-based architecture and shuffle sharding
Cells limit a failure to the tenants behind one partition only when routing, data and change delivery are partitioned too. Here is how to choose the key, size cells and check the shuffle-sharding arithmetic.
Resilience · AWS / Microsoft Azure / Slack · By Cloud Security DeskPrepare Azure automation for mandatory MFA on resource management
Azure now requires MFA for user accounts that write through Resource Manager. Find the scripts and pipelines that still sign in as people and move each one to a managed identity or federated credential.
Identity & access · Microsoft Azure / Microsoft Entra / GitHub / Azure DevOps / HashiCorp Terraform · By Cloud Security DeskStop S3 ransomware that encrypts objects with customer-provided keys
SSE-C ransomware rewrites S3 objects under a key only the attacker holds. AWS now blocks SSE-C by default on most buckets; this guide covers what that default misses and the controls that close the gap.
Detection & response · Amazon Web Services · By Cloud Security DeskInvestigate a CI supply chain compromise from workflow logs to rotated secrets
When an action or package in your pipeline turns out to be malicious, scope the response by exposure window and by what each affected job could reach, then revoke together and hunt for use.
Detection & response · GitHub / AWS / npm · By Cloud Security DeskBuild an inventory of non-human identities across cloud accounts
Find every service account, service principal, role and key across AWS, Entra and Google Cloud, then record the owner, credential type, privilege and last use that turn a list into decisions.
Identity & access · Amazon Web Services / Microsoft Entra / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskEncrypt Kubernetes Secrets at rest with a KMS v2 provider
KMS v2 keeps etcd copies and backups unreadable without an external key, but it does not stop API readers. Configure it, compare what EKS, AKS and GKE already do, and finish key rotations with a rewrite.
Workload security · Kubernetes / Amazon EKS / AWS KMS / Azure Kubernetes Service / Azure Key Vault / Google Kubernetes Engine / Cloud KMS · By Cloud Security DeskCompare managed prompt attack filters in Bedrock, Azure and Vertex AI
Bedrock Guardrails, Azure Prompt Shields and Google Cloud Model Armor all score text for injected instructions. They differ in which content reaches the classifier, how you mark it, and what each one skips.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskPlan for the backlog that follows a regional cloud outage
AWS fixed the DNS fault behind its October 2025 us-east-1 outage within three hours, yet recovery ran into the afternoon. Design retries, queues and capacity automation for that second phase.
Resilience · Amazon Web Services · By Cloud Security DeskLet AWS workloads call external services with IAM-issued tokens
IAM outbound identity federation lets an AWS role trade its credentials for a signed JWT instead of storing a vendor API key. AWS controls issuance; the receiving service's claim checks decide what the token is worth.
Identity & access · Amazon Web Services / AWS IAM / AWS STS / Microsoft Entra · By Cloud Security DeskNormalize cloud security logs with OCSF before writing detections
OCSF puts CloudTrail, Azure Activity Log and Google audit records into the same API Activity fields. Detections still depend on the mapping, the schema version and provider semantics that normalization does not erase.
Detection & response · Open Cybersecurity Schema Framework / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskBuild a cryptographic inventory for the post-quantum transition
Record where public-key cryptography protects long-lived data and which library, service or vendor must change it. Then rank entries by function and data lifetime, not by how many RSA keys a scanner found.
Workload security · NIST / CISA / Office of Management and Budget / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskTrack EU AI Act deadlines after the Digital Omnibus delay
The Digital Omnibus moved high-risk AI duties to December 2027 and August 2028, but prohibitions, AI literacy and Article 50 transparency already apply. See which dates moved and what cloud teams should build now.
AI systems · European Union / European Commission · By Cloud Security DeskDefend cloud admin accounts against help desk social engineering
Attackers who talk a help desk into resetting MFA inherit every cloud console behind single sign-on. Verify callers properly, shrink what a reset hands over, and alert on the events it leaves.
Detection & response · Microsoft Entra / Okta / Amazon Web Services / CISA / Mandiant · By Cloud Security DeskLimit what Google Cloud principals can reach with principal access boundaries
Allow and deny policies sit on resources. A principal access boundary travels with the identity and limits which projects, folders and organizations it may touch, even where someone else granted it a role.
Identity & access · Google Cloud · By Cloud Security DeskPrepare a cloud exit strategy that satisfies DORA
DORA requires a tested exit plan for every cloud service that supports a critical or important function. This guide turns that duty into dependency maps, measured data exports, staged tests and register entries that agree.
Resilience · European Commission / European Supervisory Authorities / European Central Bank / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskProtect and recover your AWS root account
Protect AWS root access with MFA, current recovery contacts, separate daily administration, and a clear plan for Organizations member accounts.
Identity & access · AWS · By Cloud Security DeskRemove unused AWS access keys without breaking a job
Review IAM access-key usage, find job dependencies, deactivate safely, and verify final deletion without collecting or exposing secret credentials.
Identity & access · AWS · By Cloud Security DeskChoose and verify CloudWatch Logs retention
Choose CloudWatch Logs retention from supported values, verify the saved setting, and account for delayed deletion, archives, and log-group ownership.
Detection & response · AWS · By Cloud Security DeskKeep an S3 bucket private with Block Public Access
Enable S3 Block Public Access while preserving approved readers. Review the four settings, private CloudFront origins, and practical access tests.
Workload security · AWS · By Cloud Security DeskRemove public SSH access from an EC2 security group
Remove internet-wide EC2 SSH rules after testing Session Manager or restricted SSH. Check all groups, IPv6, fresh sessions, and recovery access.
Workload security · AWS · By Cloud Security DeskCount tokens before sending a prompt to Amazon Bedrock
Count a Bedrock prompt for the chosen model, check endpoint support, distinguish context and output limits, and verify usage without logging prompts.
AI systems · AWS · By Cloud Security Desk