Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “Authentication”
19 publicationsPasskey deployment needs a recovery design
A workforce passkey rollout needs a recovery contract before broad enforcement. Separate credential custody, enrollment evidence and application sessions.
Identity & access · NIST / FIDO Alliance / Microsoft Entra · By Cloud Security DeskWorkload federation across clouds needs separate trust decisions
Cross-cloud federation adds trust decisions, not a portable permission system. Map each credential and resource grant before moving a runtime workload.
Identity & access · AWS / Google Cloud / Microsoft Entra · By Cloud Security DeskEntra emergency access that survives normal sign-in failure
A second administrator account does not prove an independent recovery path. Test the credential, workstation, policy and alert dependencies together.
Identity & access · Microsoft Entra · By Cloud Security DeskMake secret rotation reach every running application
Secret managers, mounted files, application memory and connection pools can disagree about the active credential. Test each stage before calling rotation complete.
Workload security · Kubernetes / AWS / Azure / Google Cloud · By Cloud Security DeskRotate Entra application certificates with proof of adoption
A renewed certificate can exist in Key Vault while a running client still uses the old key. Define the evidence that makes application rotation complete.
Identity & access · Microsoft Entra / Azure Key Vault · By Cloud Security DeskDesign an outbound fetch service that contains SSRF
A URL check is only the first decision. The fetch worker must contact the approved destination, recheck redirects and limit the authority of every request.
Workload security · OWASP / IANA · By Cloud Security DeskShort SSH certificates still need explicit access boundaries
An SSH certificate supplies bounded identity claims. The issuer, server, client and incident operator still make separate access decisions.
Identity & access · OpenSSH · By Cloud Security DeskCertificate renewal under shorter validity limits
Use the public TLS issuance schedule to review authorization, renewal, deployment and independent verification of the certificate an endpoint actually serves.
Resilience · CA/Browser Forum / Let's Encrypt / AWS · By Cloud Security DeskThe telemetry collector is part of the evidence boundary
Review sender identity, tenant routing, processing and export as separate trust boundaries before treating collected telemetry as dependable evidence.
Detection & response · OpenTelemetry · By Cloud Security DeskPrepare cloud workloads for hybrid post-quantum TLS
Hybrid support in a library is not proof that every TLS hop uses it. Verify negotiation, compatibility and fallback while keeping certificate authentication separate.
Workload security · IETF / NIST / OpenSSL / Cloudflare · By Cloud Security DeskKnow when AWS KMS encryption needs an envelope
KMS Encrypt has small plaintext limits. Follow the data key and encrypted-message format when an application needs to protect larger payloads.
Workload security · AWS · By Cloud Security DeskProve Azure Storage private access from DNS to authorization
Check the exact storage subresource, resolve its normal hostname from the application, and test public access and data permissions as separate boundaries.
Workload security · Azure · By Cloud Security DeskKeep tenant data out of reusable AWS Lambda state
Reuse clients and connections deliberately, while keeping request identity, temporary files, and initialization snapshots inside clearly defined data lifetimes.
Workload security · AWS · By Cloud Security DeskRequire EC2 IMDSv2 without breaking container credentials
Separate metadata token requirements from response hop limits, then verify both existing instances and future launches before declaring the migration complete.
Workload security · AWS · By Cloud Security DeskInvestigate an Entra application through grants and sign-ins
A successful service-principal sign-in is one event in a larger sequence. Connect it to credential changes, permission grants and the resource involved.
Detection & response · Microsoft Entra · By Cloud Security DeskDefine the expiry boundary for Entra privileged access
PIM records activation and expiry, but the protected application still determines when changed authority takes effect. Review both sides of that boundary.
Identity & access · Microsoft Entra · By Cloud Security DeskClose the AWS sessions that survive identity shutdown
Removing a login does not by itself establish that issued AWS credentials have lost their authority. Build a revocation procedure that accounts for both.
Identity & access · AWS · By Cloud Security DeskQwen3.8-Flash-Next and GLM-5.3-Flash share a 3:1 long-context pattern
Both models replace most conventional attention layers with recurrent state and reserve sparse attention for periodic retrieval. Their differences lie in where they place capacity, how much neural computation they activate, and what their serving stacks must keep trustworthy.
AI systems · Resilience · By Umair Akbar and Ahmed ElshekhWhat changes when static keys disappear
Workload identity removes a secret, but it also moves trust into issuers, claims, audiences, and runtime attachment points.
Identity & access · Workload security · AWS / Azure / Google Cloud · By Umair Akbar and Ahmed Elshekh