Skip to content
Cloud Security DeskSearch
Menu

Evidence search

Search

Search titles, summaries, topics, providers, authors, and the full open-access corpus.

Results for “managed”

47 publications
Technical guideSource-based analysis

Passkey deployment needs a recovery design

A workforce passkey rollout needs a recovery contract before broad enforcement. Separate credential custody, enrollment evidence and application sessions.

Identity & access · NIST / FIDO Alliance / Microsoft Entra · By Cloud Security Desk
Technical guideSource-based analysis

Workload federation across clouds needs separate trust decisions

Cross-cloud federation adds trust decisions, not a portable permission system. Map each credential and resource grant before moving a runtime workload.

Identity & access · AWS / Google Cloud / Microsoft Entra · By Cloud Security Desk
Technical guideSource-based analysis

A defensible cloud patch queue starts with exploitation evidence

Join exploitation evidence to affected assets, exposure, ownership and verified remediation without turning CVSS, EPSS or a catalog entry into a complete risk score.

Detection & response · CISA / NIST / FIRST · By Cloud Security Desk
Technical guideSource-based analysis

Entra emergency access that survives normal sign-in failure

A second administrator account does not prove an independent recovery path. Test the credential, workstation, policy and alert dependencies together.

Identity & access · Microsoft Entra · By Cloud Security Desk
Technical guideSource-based analysis

What cloud snapshots cannot preserve

Separate live execution, persisted disk and provider records before an authorized containment decision destroys evidence that a snapshot cannot recover.

Detection & response · AWS / NIST · By Cloud Security Desk
Technical guideSource-based analysis

Make secret rotation reach every running application

Secret managers, mounted files, application memory and connection pools can disagree about the active credential. Test each stage before calling rotation complete.

Workload security · Kubernetes / AWS / Azure / Google Cloud · By Cloud Security Desk
Technical guideSource-based analysis

Design an outbound fetch service that contains SSRF

A URL check is only the first decision. The fetch worker must contact the approved destination, recheck redirects and limit the authority of every request.

Workload security · OWASP / IANA · By Cloud Security Desk
Technical guideSource-based analysis

Where fine tuning data needs a trust boundary

A training dataset can preserve its checksum and still teach the wrong behavior. Admission controls need to separate origin, transformation, approved use and the model change they produce.

AI systems · By Cloud Security Desk
Technical guideSource-based analysis

Short SSH certificates still need explicit access boundaries

An SSH certificate supplies bounded identity claims. The issuer, server, client and incident operator still make separate access decisions.

Identity & access · OpenSSH · By Cloud Security Desk
Technical guideSource-based analysis

Certificate renewal under shorter validity limits

Use the public TLS issuance schedule to review authorization, renewal, deployment and independent verification of the certificate an endpoint actually serves.

Resilience · CA/Browser Forum / Let's Encrypt / AWS · By Cloud Security Desk
Technical guideSource-based analysis

Measure SCIM offboarding at the application

A successful provisioning update proves a directory action, not the end of every application session. Define and test the application's offboarding contract.

Identity & access · SCIM / Microsoft Entra · By Cloud Security Desk
Technical guideSource-based analysis

Prepare cloud workloads for hybrid post-quantum TLS

Hybrid support in a library is not proof that every TLS hop uses it. Verify negotiation, compatibility and fallback while keeping certificate authentication separate.

Workload security · IETF / NIST / OpenSSL / Cloudflare · By Cloud Security Desk
Technical guideSource-based analysis

Know when AWS KMS encryption needs an envelope

KMS Encrypt has small plaintext limits. Follow the data key and encrypted-message format when an application needs to protect larger payloads.

Workload security · AWS · By Cloud Security Desk
Technical guideSource-based analysis

Map every connection beyond the private AI endpoint

Trace inference, retrieval, tools, administration, and telemetry separately before describing an AI application as private.

AI systems · AWS · By Cloud Security Desk
Technical guideSource-based analysis

Prove Azure Storage private access from DNS to authorization

Check the exact storage subresource, resolve its normal hostname from the application, and test public access and data permissions as separate boundaries.

Workload security · Azure · By Cloud Security Desk
Technical guideSource-based analysis

Keep tenant data out of reusable AWS Lambda state

Reuse clients and connections deliberately, while keeping request identity, temporary files, and initialization snapshots inside clearly defined data lifetimes.

Workload security · AWS · By Cloud Security Desk
Technical guideSource-based analysis

Measure GuardDuty runtime coverage from the resource outward

An enabled protection plan does not describe the health of every workload. Review supported resources, agents, connectivity and the denominator behind coverage.

Detection & response · AWS · By Cloud Security Desk
Technical guideSource-based analysis

Keep encryption keys recoverable with the data they protect

Trace each encrypted recovery point to its required key, usable lifecycle state, and restore permissions before retiring cryptographic dependencies.

Resilience · AWS / Azure · By Cloud Security Desk
Technical guideSource-based analysis

Investigate an Entra application through grants and sign-ins

A successful service-principal sign-in is one event in a larger sequence. Connect it to credential changes, permission grants and the resource involved.

Detection & response · Microsoft Entra · By Cloud Security Desk
Research noteSource-based analysis

Define the expiry boundary for Entra privileged access

PIM records activation and expiry, but the protected application still determines when changed authority takes effect. Review both sides of that boundary.

Identity & access · Microsoft Entra · By Cloud Security Desk
Technical guideSource-based analysis

Protect backup copies from the account that runs production

Map deletion authority, retention protection, keys, and recovery identities so a surviving backup has a usable path back to service.

Resilience · AWS · By Cloud Security Desk
Technical guideSource-based analysis

Keep private documents out of shared RAG answers

Authorize retrieved documents before they enter model context, preserve permissions on chunks, and make source access changes visible in the retrieval path.

AI systems · Azure · By Cloud Security Desk
Research reportDesk publication

Qwen3.8-Flash-Next and GLM-5.3-Flash share a 3:1 long-context pattern

Both models replace most conventional attention layers with recurrent state and reserve sparse attention for periodic retrieval. Their differences lie in where they place capacity, how much neural computation they activate, and what their serving stacks must keep trustworthy.

AI systems · Resilience · By Umair Akbar and Ahmed Elshekh