Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “RPO”
116 publicationsKnow when AWS KMS encryption needs an envelope
KMS Encrypt has small plaintext limits. Follow the data key and encrypted-message format when an application needs to protect larger payloads.
Workload security · AWS · By Cloud Security DeskModel output needs its own trust boundary
A model can produce valid JSON containing an unauthorized identifier, an unsafe link or text that a renderer interprets as code. The application consuming that output owns the next trust decision.
AI systems · OpenAI · By Cloud Security DeskWhere DNS failover loses control of the clock
Separate authoritative routing, resolver caches, stale answers, runtime caching and existing connections when describing what DNS failover can achieve.
Resilience · AWS / Cloudflare / Oracle · By Cloud Security DeskKeep database changes compatible with application rollback
Preserve an explicit relationship between old code and migrated state through additive changes, safe backfills, and a defined rollback window.
Resilience · Kubernetes / GitLab · By Cloud Security DeskMap every connection beyond the private AI endpoint
Trace inference, retrieval, tools, administration, and telemetry separately before describing an AI application as private.
AI systems · AWS · By Cloud Security DeskTrace Google service account impersonation across every hop
A short-lived token can carry a broad identity. Review who can mint it, which account it represents and whether the original caller remains visible.
Identity & access · Google Cloud · By Cloud Security DeskKeep sensitive prompts out of routine telemetry
Collect diagnostic metadata for a defined purpose and treat prompts, retrieved documents, tool arguments, and responses as a separate content-capture decision.
AI systems · AWS · By Cloud Security DeskPlace AWS guardrails on the principal and the resource
SCPs and RCPs constrain different sides of a request. A useful review records both the applicable guardrails and the policies that actually grant access.
Identity & access · AWS · By Cloud Security DeskPut enforceable boundaries around agent tool calls
Treat model proposals as requests for authority, then check the operation, resource, recipient, and approval at the point where a tool can create a side effect.
AI systems · AWS · By Cloud Security DeskVerify container provenance before admitting a pinned image
Use the digest to identify the artifact, then check who signed it, which builder produced it, and which evidence survived promotion into the deployment registry.
Workload security · Kubernetes / Docker / Sigstore · By Cloud Security DeskReview the authority behind every Entra app consent
The permission name is only part of the decision. Review the access mode, resource scope, consenting authority and people who can change the application.
Identity & access · Microsoft Entra · By Cloud Security DeskTreat model downloads as software supply chain changes
Review weights, custom code, dependencies, and runtime authority as separate decisions before promoting a downloaded model into a trusted environment.
AI systems · Hugging Face · By Cloud Security DeskRequire EC2 IMDSv2 without breaking container credentials
Separate metadata token requirements from response hop limits, then verify both existing instances and future launches before declaring the migration complete.
Workload security · AWS · By Cloud Security DeskMeasure recovery by the service you can restore
Define application acceptance, recoverable data, and a complete timeline before treating a completed restore job as proof of recovery.
Resilience · AWS / PostgreSQL · By Cloud Security DeskVerify the CloudTrail files behind an incident timeline
Digest delivery and successful validation are different evidence states. Preserve the files, metadata and validation result needed to distinguish them.
Detection & response · AWS · By Cloud Security DeskClose the AWS sessions that survive identity shutdown
Removing a login does not by itself establish that issued AWS credentials have lost their authority. Build a revocation procedure that accounts for both.
Identity & access · AWS · By Cloud Security DeskRoll out Kubernetes Pod Security Admission without surprises
Stage namespace enforcement around the Pods a controller will create next, with explicit policy versions, runtime checks, and narrowly owned exceptions.
Workload security · Kubernetes · By Cloud Security DeskChoose the S3 object events your investigation will need
CloudTrail event history is not an object-access ledger. Build selectors around the questions an investigation must answer, then test the exclusions.
Detection & response · AWS · By Cloud Security DeskCloud logs that never reach the SIEM
A dashboard can be healthy while the evidence behind it is incomplete. Coverage needs to be tested from event creation to searchable record.
Detection & response · AWS / Azure / Google Cloud · By Umair Akbar and Ahmed ElshekhThreat-model the system around the model
The model endpoint is one component. The consequential paths often run through retrieval stores, orchestration identities, evaluation data, and operator tools.
AI systems · AWS / Azure / Google Cloud · By Umair Akbar and Ahmed Elshekh