Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “key”
66 publicationsCertificate renewal under shorter validity limits
Use the public TLS issuance schedule to review authorization, renewal, deployment and independent verification of the certificate an endpoint actually serves.
Resilience · CA/Browser Forum / Let's Encrypt / AWS · By Cloud Security DeskMeasure SCIM offboarding at the application
A successful provisioning update proves a directory action, not the end of every application session. Define and test the application's offboarding contract.
Identity & access · SCIM / Microsoft Entra · By Cloud Security DeskPrepare cloud workloads for hybrid post-quantum TLS
Hybrid support in a library is not proof that every TLS hop uses it. Verify negotiation, compatibility and fallback while keeping certificate authentication separate.
Workload security · IETF / NIST / OpenSSL / Cloudflare · By Cloud Security DeskKnow when AWS KMS encryption needs an envelope
KMS Encrypt has small plaintext limits. Follow the data key and encrypted-message format when an application needs to protect larger payloads.
Workload security · AWS · By Cloud Security DeskModel output needs its own trust boundary
A model can produce valid JSON containing an unauthorized identifier, an unsafe link or text that a renderer interprets as code. The application consuming that output owns the next trust decision.
AI systems · OpenAI · By Cloud Security DeskMap every connection beyond the private AI endpoint
Trace inference, retrieval, tools, administration, and telemetry separately before describing an AI application as private.
AI systems · AWS · By Cloud Security DeskProve Azure Storage private access from DNS to authorization
Check the exact storage subresource, resolve its normal hostname from the application, and test public access and data permissions as separate boundaries.
Workload security · Azure · By Cloud Security DeskKeep tenant data out of reusable AWS Lambda state
Reuse clients and connections deliberately, while keeping request identity, temporary files, and initialization snapshots inside clearly defined data lifetimes.
Workload security · AWS · By Cloud Security DeskPlace AWS guardrails on the principal and the resource
SCPs and RCPs constrain different sides of a request. A useful review records both the applicable guardrails and the policies that actually grant access.
Identity & access · AWS · By Cloud Security DeskKeep encryption keys recoverable with the data they protect
Trace each encrypted recovery point to its required key, usable lifecycle state, and restore permissions before retiring cryptographic dependencies.
Resilience · AWS / Azure · By Cloud Security DeskVerify container provenance before admitting a pinned image
Use the digest to identify the artifact, then check who signed it, which builder produced it, and which evidence survived promotion into the deployment registry.
Workload security · Kubernetes / Docker / Sigstore · By Cloud Security DeskRequire EC2 IMDSv2 without breaking container credentials
Separate metadata token requirements from response hop limits, then verify both existing instances and future launches before declaring the migration complete.
Workload security · AWS · By Cloud Security DeskInvestigate an Entra application through grants and sign-ins
A successful service-principal sign-in is one event in a larger sequence. Connect it to credential changes, permission grants and the resource involved.
Detection & response · Microsoft Entra · By Cloud Security DeskDefine the expiry boundary for Entra privileged access
PIM records activation and expiry, but the protected application still determines when changed authority takes effect. Review both sides of that boundary.
Identity & access · Microsoft Entra · By Cloud Security DeskMeasure recovery by the service you can restore
Define application acceptance, recoverable data, and a complete timeline before treating a completed restore job as proof of recovery.
Resilience · AWS / PostgreSQL · By Cloud Security DeskProtect backup copies from the account that runs production
Map deletion authority, retention protection, keys, and recovery identities so a surviving backup has a usable path back to service.
Resilience · AWS · By Cloud Security DeskQwen3.8-Flash-Next and GLM-5.3-Flash share a 3:1 long-context pattern
Both models replace most conventional attention layers with recurrent state and reserve sparse attention for periodic retrieval. Their differences lie in where they place capacity, how much neural computation they activate, and what their serving stacks must keep trustworthy.
AI systems · Resilience · By Umair Akbar and Ahmed ElshekhWhat changes when static keys disappear
Workload identity removes a secret, but it also moves trust into issuers, claims, audiences, and runtime attachment points.
Identity & access · Workload security · AWS / Azure / Google Cloud · By Umair Akbar and Ahmed Elshekh